Full Breakdown
“Black October”: AI-Driven PHP Flaws Spark a Global Cybersecurity Surge
By Drooid · · How we work
Core Event – AI-Discovered PHP Vulnerabilities Trigger Emergency Patching
In late October 2026, two critical flaws in PHP—dubbed php2shell (CVE-2026-109618 and CVE-2026-109619)—allow unauthenticated remote code execution and memory disclosure on any version since 5.4. Researchers at Google’s Wiz and the AI firm Calif identified the vulnerabilities with frontier models in August 2026 and coordinated a patch released on October 21. The disclosure prompted emergency patches, website shutdowns, and a scramble among governments and corporations to remediate the flaw.
Background & Context – AI as a Double-Edged Sword in Vulnerability Research
PHP powers roughly 70 % of websites, making the exposure massive. Earlier in the year AI-assisted discovery had surfaced a critical GitLab vulnerability and a supply-chain attack on the open-source LiteLLM library. The “Black October” label first appeared in an X post on October 22, describing the preceding 48 hours as “the worst in cybersecurity history.”
Data & Statistics – Scope of the Threat Landscape
- 1.5 million of the 2.6 million servers surveyed by Censys were still running unpatched PHP versions.
- Cloudflare observed exploit attempts rise from thousands to tens of thousands within 45 minutes of disclosure, then to hundreds of thousands within two hours, and eventually to millions.
- Approximately 30 000 eMudhra TLS certificates required replacement after weak private keys were discovered.
Official Statements & Responses – Government and Industry Alerts
- The United Kingdom’s National Cyber Security Centre and Japan’s Prime Minister Sanae Takaichi advised organizations to verify PHP usage and deploy the emergency fix immediately.
- Amazon’s threat-intelligence team reported an exploitation attempt on October 17, four days before public disclosure, against a decoy system.
- eMudhra said the weak-key incident affected only its global TLS business and announced a voluntary withdrawal from the global SSL/TLS market.
Criticism & Opposition – Experts Warn of an Unmanageable Patch Burden
- “I no longer think we’re going to be able to patch all bugs,” warned Sam Altman, CEO of OpenAI.
- Jason Clinton, deputy CISO at Anthropic, said there won’t be enough time to patch critical infrastructure.
- Costin Raiu, co-founder of TLP:Black, described the situation as an “AI-fuelled race to exploit.”
Conflicting Reports & Gaps – Uncertainty Over Exploit Scale and Certificate Timeline
- Cloudflare’s telemetry reports “millions” of exploit attempts within hours of the PHP patch release, while other outlets have only quantified “tens of thousands,” showing a lack of consensus on attack volume.
- The weak private keys in eMudhra’s intermediate certificates were generated on April 30 2025, but the compromise was not disclosed until mid-October 2026, leaving the duration of exposure unclear.
What’s Next – Ongoing Mitigation and Market Reactions
- Security firms continue to monitor for active exploits, with providers publishing real-time dashboards of attack traffic.
- Cybersecurity stocks surged after the disclosures, with Palo Alto Networks, CrowdStrike, Cloudflare, and Okta posting double-digit weekly gains.
- Analysts caution that the rapid AI-enabled discovery cycle may produce additional high-severity bugs in the coming months, emphasizing the need for continuous vulnerability scanning and accelerated patch deployment.