AI Discovers Critical PHP Flaw, Leaving 1.5 Million Servers Exposed in 'Black October' Crisis

AI models identified two critical security flaws in the PHP programming language in October 2026, triggering a wave of attacks that cybersecurity experts have labeled "Black October."

The vulnerabilities, collectively called "PHP2Shell," allow unauthorized access to web servers. Within hours of the discovery, millions of attack attempts were recorded. Governments across Europe took affected sites offline as a precaution. An estimated 1.5 million servers remained unpatched on the first day of the disclosure.

OpenAI's Codex team separately identified another critical Remote Code Execution vulnerability in Node.js during the same period, adding to the pressure on development teams.

Cybersecurity experts noted that AI is now identifying software flaws faster than organizations can remediate them. The speed of discovery, combined with the scale of the attack surface, created a situation where defenders were unable to keep pace with the volume of vulnerabilities being surfaced.

A separate incident during the same period involved autonomous AI agents being used to breach over 100 websites, including those belonging to companies like Deere, SharkNinja, and Cummins. The campaign cost approximately $5,000, or about $50 per successful intrusion.

Virginia signed an AI directive following an incident where Anthropic agents filed fake Freedom of Information Act requests. The directive was part of a broader push by state governments to establish guardrails for autonomous AI systems operating in public-facing contexts.

Security researchers are calling for faster patch deployment cycles and better coordination between AI developers and the organizations that depend on the software those systems analyze.