Government portals have gone dark; a PHP flaw buried in internet infrastructure for more than a decade has triggered an emergency patching scramble, and compromised software packages threaten passwords and cloud credentials. Security teams face a pile-up of incidents that is becoming hard to contain.
October has become a month of cybersecurity whack-a-mole, with one critical vulnerability after another forcing emergency patches, shutdowns, and frantic investigations. Just as security teams scramble to contain one threat, another lands on their desks. While large organizations race to protect their systems, millions of smaller websites, neglected servers, and forgotten corners of the internet could remain exposed long after the headlines move on.
The big PHP flaw
Wikipedia and the Internet Archive briefly took services offline on October 21, as did websites and services in the Netherlands, France, Denmark and Finland, while operators frantically worked to implement an emergency fix. The US National Security Agency and the UK’s National Cyber Security Center put out warnings. In Japan, Prime Minister Sanae Takaichi urged people to check whether their websites run on PHP and be ready to implement a fix.
PHP, the server-side programming language that runs an estimated 70% of websites, was hit with a critical vulnerability that could allow attackers to take control of servers and databases, potentially giving them access to all sorts of data. Cybersecurity pros have begun calling the month’s string of events “Black October”, a nod not to any coordinated campaign but to the severity and number of events hitting the industry at once.
AI helped uncover the vulnerability, which security researchers call php2shell and say went unnoticed for over a decade, but the same technology could quickly craft exploits. The PHP team urged people to install patches released on October 21. But according to Censys, an internet intelligence company, around 1.5 million of the 2.6 million servers it analyzed reported PHP versions without an available patch.
AI-found bugs could fuel a “race to exploit”
Security company Calif said it found the vulnerability using a large language model on August 1 and has since been working on a fix. Wiz, separately, said it discovered the flaw using its own autonomous security research product, Wiz Atlas, and two frontier models: Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Wiz said the team coordinated its efforts with Calif and the PHP project.
Amazon had already detected an attempt to exploit the PHP flaws days before they became public. CJ Moses, the company’s chief information security officer, said Amazon’s threat-intelligence team recorded an attack attempt on October 17, four days before disclosure, against a decoy system used to detect hackers. Further attempts followed, and Amazon said PHP2Shell was facing widespread exploitation attempts.
Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black, described the situation as an AI-fuelled race to exploit vulnerabilities, as attackers look to take advantage of flaws before organizations can patch their systems.
Other recent security incidents
Other recent events fueling the “Black October” moniker include GitLab recently disclosing a critical vulnerability (CVSS 10.0 being the maximum severity rating) that could let an unauthenticated threat actor execute arbitrary code on GitLab self-managed instances. GitLab has released a fix, with patches available across several branches, including older versions.
LiteLLM, an open-source project that acts as a proxy between apps and various LLM providers, recently disclosed a supply-chain attack involving compromised releases published via container registries and PyPI. According to Wiz, the malicious LiteLLM versions included code that could enable remote access and steal credentials. Wiz said such compromises could be especially impactful because AI infrastructure often contains cloud credentials, API keys, and other secrets that grant access to other systems.
In India, scrutiny has fallen on eMudhra, a company that issues TLS certificates used to validate websites to users’ web browsers, after Wiz reported weak private keys linked to eight of the company’s intermediate certificate authorities.
CERT-In, India’s Computer Emergency Response Team, said the vulnerable keys were generated with insufficient randomness, meaning attackers could potentially calculate the private keys from the public keys almost instantly. eMudhra said its systems and data were not compromised and that the issue affects only its global TLS certificate business, not its digital-signature certificate business or eSign business in India.
The fallout has been significant: Google, Apple, Microsoft and Mozilla moved to block the affected certificates, and eMudhra announced it would withdraw from the global SSL/TLS certificate business. The weakness had reportedly survived 18 months and two rounds of audits, while the company says the business accounts for just 1% of its revenue.
How to protect yourself
Apply the PHP patch, upgrade other impacted software, rotate exposed keys or secrets, and scan for malicious activity in case a threat actor has already abused the flaw.
AI-fueled code analysis and researcher-led vulnerability discovery are just the beginning. Threat actors could eventually use the technology to automate exploitation at scale, and the recent PHP vulnerability is just one example.
Not everything on the Black October list is connected, and some claims still need to be verified. But the PHP flaws, the GitLab vulnerability, the LiteLLM supply-chain attack and the eMudhra certificate crisis have all landed in the same month, leaving security teams with a growing list of problems to deal with.
The bigger worry is that even when a fix is available, plenty of organizations may not know which systems they need to patch, who is responsible for them, or whether attackers have already got in. In a month like this, simply knowing what you’re running could be the difference between catching a threat and becoming the next headline.
In case you missed:
- Japan Declares Cybersecurity Emergency: AI Cyberattacks Hit 14 Million People and 495 Businesses
- The End of Hacking? India Successfully Tests ‘100% Uncrackable’ Quantum Laser Tech
- Malware with AI-Powered Code Mutations: Google Sounds the Alarm!
- OpenAI’s AI Caught Leaving Notes for Its Future Self on How to Escape Internal Controls
- OpenAI Just Revealed Its AI Went Rogue. The Rest of the Story Is Even Stranger.
- The Hugging Face Incident: How OpenAI’s Agents Learnt to “Sacrifice” Themselves for the Greater Good
- Not Just Oil: Iran War Could Put India’s Internet Connectivity at Risk
- India’s Mappls Revolution: The Swadeshi Push to Dethrone Google Maps
- GPT-6 Astra Is Here. OpenAI Says the AGI Era Has Begun
- Amazon Caught Destroying Rare Books to Feed AI: Historians and Book Lovers Furious
