UK cyber agency says AI-powered malware will likely hit critical infrastructure by 2028

The UK's National Cyber Security Centre expects AI-powered malware to be used in a ransomware attack on the country's critical national infrastructure by 2028. It appears in the NCSC's annual review, published on 3 November.

The review says it is "highly likely" that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI, The Guardian reported. Critical national infrastructure covers energy, transport, defence, food, health and finance. The NCSC sits inside GCHQ. It also says Russia and China will start using AI "routinely" in cyber-attacks. It names the tasks AI helps with: scouting targets, locating weaknesses in networks and writing malicious code.

For hospitals, airports and power stations, the question stops being whether AI shows up in an attack and becomes how soon. The review gives no timeline finer than 2028. It also does not say which models it has in mind.

Richard Horne, the NCSC's chief executive, speaks on Tuesday. "In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents," he will say.

Horne will blame weaknesses "tolerated for far too long". The review cites an example from last month, when AI helped find a critical flaw in PHP, a language used by almost 70% of the world's websites. Alan Woodward, a professor of cybersecurity at Surrey University, told The Guardian that defenders need access to the strongest models. "If we don't get the access the bad guys will beat them to it," he said.

Attackers are already exploiting internet-facing industrial equipment. Those devices sit inside the facilities the review is worried about.

The Hacker News reported on 3 November that attackers are exploiting CVE-2026-58115 in Siemens SIMATIC IoT2050 Advanced devices, a flaw scored 10.0. Siemens's August advisory describes missing authentication in the Node-RED HTTP interface, which lets an unauthenticated attacker run code with maximum privileges. Version 4.3.4.1 or later fixes it. VulnCheck said it had seen attempts against its honeypots as of 30 October. "The attacker's request was a complete exploit," VulnCheck researcher Patrick Garrity said. Some requests left a backdoor that survives a reboot.

The software used to build AI systems is a target too. Langflow's flaws need no credentials at all.

IBM's bulletin, first published on 28 October, covers four Langflow flaws. Two of them, an authentication bypass and an arbitrary code execution bug, are both rated 9.8. Every release from 1.0.0 to 1.12.8 carries them, and 1.13.0, out on 22 October, is the only fix, The Hacker News reported on 2 November. Automatic login is on by default in 1.12.8, and its own code description warns it "bypasses authentication". Neither flaw was in CISA's Known Exploited Vulnerabilities catalog as of its 30 October update.

Drupal says a "highly critical" authorization bypass in Commerce Core, CVE-2026-118539, is being actively exploited. Versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13 are affected. Wiz put the share of organisations significantly hit by separate PHP2Shell flaws at 52.1% as of 25 October.

Governments are moving on the policy side, though not at the same speed. Two cases show how far apart the responses sit.

Ukraine's parliamentary committee on digital transformation discussed AI regulation and critical infrastructure cybersecurity on a visit to Spain and Poland, SUD.UA reported on 26 October. The delegation saw the MareNostrum 5 supercomputer in Catalonia and held talks in Warsaw on AI in public administration. Russia's answer has been criminal. A Moscow court ordered the arrest of RailGallery administrators Denis Yeskov and Anatoly Nagornov on 14 October, case files show. Meduza published its account on 19 October; they face five to 10 years.

On 3 November Bull and Schwarz Digits signed a memorandum of understanding on European AI and cloud infrastructure, HPCwire reported. The two describe the plan as an independent, secure stack under European jurisdiction. Schwarz Digits brings its STACKIT cloud; Bull brings the BullSequana AI platform and rack-scale manufacturing at its Angers factory. Neither company disclosed the value.

Data centre operators face a narrower version of the same reliability question. Badger Meter's James Arnold wrote in a sponsored Data Center Dynamics piece that rack power densities now exceed the practical limits of air cooling.

What none of this settles is pace. The NCSC's window runs to 2028. Siemens shipped a fix before the attacks arrived, and Langflow's patch landed six days before IBM's bulletin. Whether operators installed either is not public.