This week the Internet Archive went offline. So did 4chan, and so did parts of the infrastructure behind Wikipedia. Nobody had broken into them. Their operators pulled the plug themselves, because a serious flaw had just been disclosed in PHP, the decades-old programming language that runs WordPress and a large share of the websites people visit every day, and going dark for a few hours was safer than staying online unpatched. The NSA told every organization using PHP to do the same if it couldn't install the fix right away. Japan's government took some of its own sites down.
By Thursday a list was making the rounds online that counted 27 major hacks and security failures, most of them from the past few weeks, and the moment had picked up a name: Black October. Security people who normally pride themselves on staying calm were openly rattled. Matthew Green, a cryptographer at Johns Hopkins, described the internet as "dry tinder."
The list exaggerates in places, and we'll get to that. But read it closely and the same thread runs through most of the big stories on it. Artificial intelligence keeps turning up, sometimes as the tool that found the hole and sometimes as the thing that got broken into.
An old bug, solved in weeks
The two PHP flaws, which researchers nicknamed PHP2Shell, let a stranger take control of a web server without a password. Every version of PHP back to 5.4, which came out in 2012, is affected.
The weakness behind them wasn't new. It was first spotted in 2020 and flagged again in 2024, but nobody fixed it, because nobody had shown that an attacker could actually use it. Every large software project has a backlog of bugs like that, left alone because proving they're dangerous takes an expert weeks of work. This summer researchers at Calif, Wiz and OpenAI pointed AI models at this one, and within a few weeks they had their proof. We wrote about that discovery yesterday.
What happened after that should worry people more than the bug itself. Dan Lorenc, who runs the security company Chainguard, said his team found the same flaws on its own after asking an AI model to look for bad vulnerabilities in PHP. Amazon said it saw attackers going after the flaws before the patch was out. Cloudflare's CEO, Matthew Prince, posted that his network logged thousands of exploit attempts in the ten hours before the bugs were even announced, and millions once they were.
For most of the internet's history, whoever found a bug like this first was probably one of the careful ones, because finding it took rare skill and a lot of patience. You can't count on that anymore when the search can start with a well-worded request to a chatbot.
One person, a hundred companies
Around the start of October, Snorre Fagerland, a researcher at the security firm NorForge, began scanning the web for copies of Cairn, a free program that lets AI agents work toward a goal on their own, one step at a time. He found about two dozen being used by criminals. Their owners hadn't bothered to put passwords on the control panels, so he could sit back and watch them work.
One of those panels belonged to a single Chinese-speaking hacker who, over a few weeks, broke into more than 100 companies. Reuters identified some of the victims, among them Deere, SharkNinja and the engine maker Cummins. The hacker's instructions to the AI came to fewer than 100 Chinese characters, shorter than most text messages. Agents running on DeepSeek and Anthropic's Claude Code did the rest, at roughly $50 in AI fees per break-in and about $5,000 for the whole campaign.
A state-backed group has been doing the same thing on a much bigger scale. Microsoft disclosed on Wednesday that a hacking group aligned with the Chinese government has used an AI tool since September to go after hundreds of organizations, in some cases getting from a first probe to full control of a company's cloud systems in under three hours. At one point, CyberScoop reports, its agents were attempting 2,900 logins a minute.
A campaign like the one Fagerland watched used to need a crew of skilled people. This one needed a single person and a credit card.
The AI tools became targets
The companies building AI products are learning that those products make tempting targets, mostly because they tend to sit right next to the things attackers want most.
LiteLLM is a widely used piece of software that connects company apps to AI models like ChatGPT and Claude, which means it often holds the keys to those accounts. On Wednesday morning someone got into the system the LiteLLM team uses to publish updates and pushed out a version laced with malware that stole passwords, cloud logins and AI account keys. It was up for about two hours before it was pulled, and anyone who installed it in that window has to assume everything on that machine was taken. It was the second time this year LiteLLM had been compromised.
Meta's problem was more embarrassing. When it launched its Muse assistant last month, Mark Zuckerberg said the product had been built for privacy and security from the ground up. On Tuesday, researchers at a firm called Claroc showed that the links Muse created when people shared a conversation could be found through public internet records, and a single search turned up 6,800 of them. Among the few hundred they opened were a revenue report meant only for one company's CEO, a small-business loan application and a bank fraud alert with part of an account number showing. Meta has switched sharing off while it works out a fix.
A leaky share link is an old and ordinary kind of mistake. It matters more now because these assistants are asking to read people's email, run their calendars and log into their bank accounts, so an ordinary mistake can spill a great deal more than it would have a few years ago.
Everything else that went wrong
Not everything on the list involves AI, and some of it is plain bad luck piling up. eMudhra, an Indian company that vouches for websites with the digital certificates your browser checks before it trusts a site, turned out to have created eight secret keys so weak that a researcher cracked them in under a second. One of them was the number 4. Firefox has blocked the certificates. Railway and Zeabur, two services that host apps for software developers, both said attackers may have read the passwords and keys their customers stored with them. Zeabur put the damage at 321,810 accounts and said it would shut down by the end of the year. GitLab, where many companies keep their code, patched a flaw that scored a perfect 10 on the industry's severity scale. And the grocery company Ahold Delhaize, which owns Food Lion and Stop & Shop, had to take its websites and apps offline after an attack, though its stores stayed open.
How bad is it, really?
Whether this is the worst month the field has ever had depends on what you count. Some of the scariest items on the viral list are older than they look. The 600-plus organizations hit by the SafePay ransomware gang is a running total going back to August 2024. The theft of California student records, which in some cases included disability information, happened between May and September and is only now coming to light. The PHP flaws, for all the alarm, have so far done most of their damage by scaring sites offline, and 404 Media reported that a lot of the AI-written attack code being passed around online doesn't actually work.
Experience still counts for a great deal. Dan Guido, who runs the security firm Trail of Bits, said one of his engineers built a working PHP2Shell exploit in a single day with AI's help, but that engineer brought about ten years of security work to the job.
What makes this month feel different from the bad months before it is the pace. AI is shortening the time it takes to find a hole and the time it takes to write a fix. It has done nothing to shorten the time it takes a hospital, a school district or a two-person online shop to actually install that fix. Attackers do their damage in the stretch between a flaw going public and the patch reaching the last server that needs it, and that stretch is getting more dangerous to sit in every month.
What to do now
For most people the advice is dull, but it works. Update your phone, computer and browser today and leave automatic updates on. Turn on two-step login for your email and your bank. And if you've ever shared a conversation from an AI assistant, check which of those links are still public.
If you run a website or work in IT, update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or call your host if you're on something older. If anything at your company installed LiteLLM 1.107.0 on October 21, change every password and key that machine could reach. Railway and Zeabur customers should replace every key they stored there, and anyone running their own GitLab server should update it today.
