THE CRUNCH
AI-powered malware is "highly likely" to be used in a ransomware attack on UK critical national infrastructure by 2028, according to the National Cyber Security Centre. The warning, published in the NCSC's annual review on Tuesday, covers facilities such as power stations, airports and hospitals, and adds that Russia and China are expected to use AI "routinely" in cyber-attacks.
NCSC chief executive Richard Horne, in a speech accompanying the review, said AI will let attackers find vulnerabilities that have been "tolerated for far too long" and exploit them "at a scale that was once unimaginable". The report judges that AI is more likely to enhance and scale existing tactics than to uncover entirely new classes of flaws.
The review points to a recent demonstration of that capability: AI-assisted research has been credited with uncovering critical weaknesses in PHP, the programming language behind roughly 70% of the world's websites, which could in theory have allowed unauthenticated remote control of web servers. The Guardian reported one critical weakness found last month; SecurityWeek reported two critical flaws identified last week, prompting urgent security updates. Surrey University professor Alan Woodward said the warning underlines the need for defenders to have access to cutting-edge AI too, because otherwise "the bad guys will beat them to it".
The NCSC also framed the warning in hard numbers: malicious cyber activity costs UK organisations almost $20 billion a year, and the 2025 attack on Jaguar Land Rover caused more than $260 million in direct losses. Recent hacks that raised fridge temperatures in European supermarkets above 50C were cited by Horne as evidence of how easily civilian systems can be targeted, while UK and EU member states have attributed an attempted attack on Poland's energy grid in December 2025 to Russia's FSB.