Critical PHP vulnerabilities and a reported AI-assisted campaign against Latin American financial institutions have brought fresh attention to the security risks surrounding increasingly capable automation.

The incidents involve different systems and attack methods. Together, they raise questions about how quickly organizations can detect threats, patch exposed software and control what automated agents are allowed to do.

AI Models Become Part of an Attack Operation

In an October 21 report, security company Straiker described CARLIY0S, a system it linked to CyberCartel operators targeting more than 400 banks and financial institutions across Latin America.

According to Straiker, the operation combined commercial models from Anthropic, xAI and Kimi with conventional attack tools. Models were assigned different tasks, including evaluating targets, comparing options and collecting sensitive information. The researchers also described attempts to disguise malicious requests as legitimate security testing.

Straiker said a snapshot of the group’s database contained 4,493 records, including account information, passwords and API keys. That figure represents records, rather than 4,493 confirmed compromised accounts. Similarly, the reported target count does not establish that every institution was successfully breached.

The findings describe criminals incorporating AI into their operations—not AI providers collaborating in an attack. The report also identifies human operators and conventional scripts, making “fully autonomous” an incomplete description of the campaign. Source: Straiker.

PHP Issues Emergency Security Updates

Separately, the PHP project released fixes on October 21 for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, commonly called PHP2Shell.

The official advisory says the flaws can enable remote code execution without authentication. It identifies PHP installations serving web requests as at risk and urges administrators to update. Fixed releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; organizations using distribution packages should check their vendors’ security updates.

PHP issued a further configuration advisory on October 23 concerning a separate, unusual session-handling scenario. Administrators should therefore follow the latest official guidance rather than assume that an earlier checklist covers every configuration.

The widespread use of PHP makes the vulnerabilities significant. It does not establish that every PHP website has been compromised, or that every exploitation attempt is AI-driven. Source: PHP security advisories.

Bank Accounts Raise Another Authorization Question

Separately, Axios reported that unvetted AI agents were accessing U.S. bank accounts, raising concerns over authorization. Source: Axios.

This points to a broader design challenge: an agent’s ability to complete a task should not automatically give it permission to perform every action along the way. Reading information, changing settings and moving money require different controls.

Faster Automation Requires Clearer Limits

These reports do not establish that the internet has suffered a single AI takeover. They show how software vulnerabilities, stolen credentials and poorly controlled automation can create different routes to harm.

For organizations, the immediate priorities are practical: apply relevant security updates, investigate suspicious access and limit agent permissions to the work actually required.

The key question is no longer just what an AI agent can do, but who authorized it—and who can stop it.

Sources & references