Howl at us

Black October: What's Real and What's Hype

Black October is the name the internet gave to a pile-up of security news in October 2026. AI found a hidden bug under most websites, one hacker used AI agents to break into 100+ companies, and a popular AI tool shipped malware. Here's what happened, what's hype and what to do.

By The Howler ·

the updAIt: Black October, episode banner

Late on October 21, a widely shared X post called the previous 48 hours the worst in cybersecurity history. It gave the week a name: “Black October” [1]. The name spread fast. One viral list of 27 incidents passed a million views [2].

So was it the worst week ever? Hard to say. But three stories from that pile matter for anyone who uses the internet, and all three involve AI or open source software. Here they are in plain words, followed by what’s real, what’s hype and what you should do.

This is the written companion to this week’s episode of the updAIt from The Howler, a Jackall Creative podcast (jackallcreative.com).

Listen to the episode

About 15 minutes. Listen on Spotify. Also on the updAIt RSS feed.

Part 1: The 10-year bug

PHP is a programming language most people have never heard of. It runs underneath WordPress, Drupal, Joomla and Wikipedia’s software. Wiz, the security company that led the research, says PHP powers about 70% of websites [3].

On October 21, PHP released fixes for two serious flaws in PHP itself [3][4]. The researchers named them PHP2Shell. “Shell” is hacker talk for control of a computer. In the worst case, a stranger with no password could take over the server running a website, or read its memory, where passwords and keys sit [3].

Think of a big apartment building. Every tenant has their own lock, but they all share one front desk. PHP is that front desk. This bug was like a trick that gets the front desk to hand a stranger the master key, with no ID needed. The tenants did nothing wrong. The problem was in the desk they all share. Wiz says even a simple “Hello World” page on an affected PHP version could be at risk [4].

Here’s where AI comes in. Wiz says the flaws had been in PHP’s code for more than a decade, and every PHP version from the last ten years has at least one of them [3]. The hard part was proof. Showing a hacker could actually use them took a long, complicated chain of steps that was right at the edge of what human researchers could do. Wiz says frontier AI models “substantially reduced that barrier” [3]. The credits include Wiz Research, OpenAI’s Codex Security team and a firm called Calif [4].

That is the good-news version: the people who found it reported it and helped get a fix out. The bad news came fast. Akamai says details leaked before the planned October 22 disclosure [5]. Attackers were trying it the same day the patch came out [2]. The UK’s National Cyber Security Centre told organizations to take unpatched systems offline if they had to [1].

The bigger point: if AI can dig up a ten-year-old crack in something this basic, there are probably more cracks waiting. The UK agency has been warning since May to get ready for a “patch wave,” a rush of updates to fix newly found holes [1][17].

Can patching keep up? It’s a race. Every security patch fixes a hole someone found, so a wave of patches means a wave of newly found holes. Rapid7 says attackers now use a serious new flaw about three days after it goes public, on average, and 71% of the attacks it tracked came within a week [18]. Amazon says PHP2Shell attacks started on October 17, four days before the fix came out, and it now tells companies to measure patch time for internet-facing systems in hours [19].

Patching is still the best tool we have. The UK agency says to turn on automatic updates wherever you can, fix internet-facing systems first, and replace old systems that can no longer get updates [17]. There is some good news too. VulnCheck counted 1,061 bugs found with AI help in the first half of 2026, and only 14 of them (1.3%) had been used in real attacks [20].

Part 2: Unlimited hacker use

The second story is the one that sounds like science fiction.

Cairn is a free, open source AI program. You give it a starting point and a goal, and it sends a team of AI agents to work toward that goal step by step. They post what they find to a shared board as they go [6][7]. People use it for legal security testing. Criminals use it too.

A researcher named Snorre Fagerland at the security firm NorForge went looking for Cairn control panels that people had left open on the internet. Starting around October 2, he found more than 20 that looked like they were being used for crime [6][8]. Because the panels were open, he could watch the hackers work.

The busiest one looked like a single hacker. Reuters and NorForge describe that hacker as Chinese-speaking because the instructions to the agents were written in Chinese. That label describes the language only. NorForge’s code name for the cluster is AIA0001 [6][8]. That hacker ran more than 1,100 attack projects across 14 panels [7]. According to Reuters, its agents tried to break into more than 1,200 websites and got into more than 100 companies, including Deere, SharkNinja and Cummins [8][9]. The researcher put the cost at about $50 per successful hack [9]. Successful break-ins took about 23 hours [10].

The hacker barely did any of the work. The instructions telling the agents how to break in were fewer than 100 Chinese characters [10]. The agents did the probing, the testing and the breaking in. The goal looked like planting hidden upload tools on online shops, so the hackers could come back later [9].

The companies say the damage was limited. Deere told Reuters it had “no indication that sensitive information was accessed.” SharkNinja said a standalone product support site was hit and the threat was contained. Cummins said it was investigating a report about a site run by one of its vendors [8][10]. Reuters could not confirm how much data, if any, was taken [8].

Even so, this is the clearest real case of what people have been worried about. One person with a few AI agents can now do work that used to take a crew.

The AI tool that shipped a thief

The same week, LiteLLM got hit. It’s a popular open source tool that companies use to connect their apps to AI models. On October 21, a poisoned version, 1.107.0, was published. It was up on PyPI, the main download site for Python software, for about two hours [11]. It carried a program that stole passwords and keys, plus a back door that let the attacker run new code [11][12]. Wiz says it was downloaded about 49,000 times [12].

How did the attacker get in? LiteLLM says one of its own internal servers was open to the internet. That server’s logs held GitHub login tokens for three of its developers. LiteLLM says the tokens got there because Claude Code, Anthropic’s coding assistant, can sometimes include a user’s GitHub token in its output, and LiteLLM was saving that output in logs [11][13]. With those tokens, the attacker turned off safety checks and published the bad version from a lookalike account (“Berri-AI” instead of the real “BerriAI”) [11].

In plain words: an AI helper accidentally wrote a key down, the note ended up somewhere a stranger could read it, and the stranger used it to put poison in a trusted delivery.

Part 3: What’s real and what’s hype

The name “Black October” came from social media. No government or security agency coined it [1]. The name still matters. Like Black Friday or Black Monday, one short name turns a pile of separate stories into one big event, and it’s what people are searching for. It can also make the week sound bigger than it was. And the week was a pile-up of separate stories that landed at the same time. The German outlet SecurityToday found that many of these attacks started weeks or months earlier. They just all came out at once [1]. SecurityToday also notes that the official warnings this week did not blame the whole surge on AI [1].

Confirmed (with sources):

  • PHP2Shell, found with help from AI and patched October 21 [3][4]
  • One hacker group using Cairn AI agents against 1,200+ sites and getting into 100+ companies [7][8]
  • The poisoned LiteLLM release [11]
  • Developer hosting company Zeabur losing data from 321,810 accounts. It is shutting down [1][2].
  • Hosting platform Railway saying customer secrets may have been reached, and telling customers to change them [1][2]
  • A maximum-severity GitLab flaw, weak security keys at certificate company eMudhra (one was literally the number 4), and a contractor breach exposing California student records [1][2]

Unconfirmed or false (treat with care):

  • “AI agent swarms are hacking half the internet.” No source supports this [2]. Cairn is the documented case.
  • AI agents attacking 400+ Latin American banks. Only one source so far, with no bank or regulator confirming it [2].
  • A claim that 2,250+ companies were hit through ConnectWise. One investigator counted at least 162 in its own customers. Nobody has published a total [2].
  • A hacking group’s claim of stealing 110,000 keys and 10.6 TB from database company PingCAP. PingCAP confirmed a break-in but not those numbers [2].
  • “70% of websites are exposed to PHP2Shell.” PHP runs about 70% of sites, but whether a site is actually at risk depends on its version and setup [2].

So the honest version is scary enough. AI is making it cheaper to find old flaws and cheaper to attack. Defenders are using the same tools, and they found PHP2Shell first. Both sides are speeding up.

Several people saw it coming

Plenty of experts warned about this. In April, the head of the UK’s National Cyber Security Centre wrote that AI “will make it easier, faster and cheaper to discover and exploit weaknesses” [21]. In May, the agency told every organization to prepare for the patch wave [17]. One of the loudest voices was Jason Clinton, Deputy CISO (security chief) at Anthropic and a former Chrome security lead at Google [16]. Anthropic makes Claude, so he is not a neutral voice, but he called it early. On August 20 he posted: “The vulnerability tsunami is coming in just a few months and there won’t be enough time to patch critical infrastructure” [14]. On October 22 he quoted that post with an update: “as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better.” He asked security leaders to go to their boards for help “not for ai, for the basics,” and added, “we need to hold on for ~18 months” [15]. That post passed 3.4 million views [15].

In other words, one of the people building these AI tools thinks Black October is the start, and the fix is the boring stuff: updates, passwords and keeping important systems cut off from the internet.

What you should do

  1. Turn on automatic updates for your phone, computer, browser and apps.
  2. Use a password manager and a different password for every account.
  3. Turn on two-factor login (a code from an app or text) everywhere it’s offered.
  4. If a company emails you about a breach, change that password, and any account that shares it. Go to the site yourself instead of clicking the email link.
  5. Watch your bank and card statements for charges you don’t recognize, especially after shopping at smaller online stores.
  6. If you run a website, ask your host whether PHP is updated. If you use WordPress plugins, keep them updated too.
  7. Trust official notices over viral threads. A list with a million views can still be wrong.

References

  1. SecurityToday, “Black October: Many attacks had been running for months” (Oct 22, 2026): https://www.securitytoday.de/en/2026/10/22/black-october-many-attacks-had-been-running-for-months/
  2. Zero Hunt, “Black October 2026: Verified Incident Tracker” (Oct 22, updated Oct 23, 2026): https://zerohunt.ai/blog/black-october-2026-verified-incident-tracker/
  3. Wiz, “PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet” (Oct 21, 2026): https://www.wiz.io/blog/php2shell-php-rce
  4. PHP2Shell disclosure site: https://www.php2shell.com/
  5. Akamai, “Understanding PHP2Shell: Everything You Need to Know” (Oct 2026): https://www.akamai.com/blog/security-research/understanding-php2shell-everything-you-need-to-know
  6. NorForge, “Inside Cairn: Open Windows into massive AI-Driven Cyber Operations” (Oct 2026): https://norforge.com/blog/inside_cairn
  7. SecurityWeek, “AI Platform Cairn Abused to Hack Over 100 Organizations” (Oct 2026): https://www.securityweek.com/ai-platform-cairn-abused-to-hack-over-100-organizations/
  8. Reuters via Investing.com, “Exclusive: How one hacker used AI agents and a few thousand dollars to break into scores of sites” (Oct 19, 2026): https://www.investing.com/news/stock-market-news/exclusivehow-one-hacker-used-ai-agents-and-a-few-thousand-dollars-to-break-into-scores-of-sites-4956846
  9. The Next Web, “AI agents broke into 100+ sites for one hacker at $50 each, researcher says” (Oct 2026): https://thenextweb.com/news/ai-agents-hacker-cairn-100-sites-deere-norforge
  10. The Verge, “A hacker broke into John Deere and SharkNinja with an army of AI agents” (Oct 2026): https://www.theverge.com/ai-artificial-intelligence/1013643/ai-agents-hack-john-deere-shark-ninja-cummins
  11. LiteLLM, “Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised” (Oct 21, 2026): https://docs.litellm.ai/blog/security-incident-oct-21-2026
  12. Wiz, “LiteLLM Compromised, Steals Credentials” (Oct 2026): https://www.wiz.io/blog/litellm-compromised-steals-credentials
  13. The Hacker News, “LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release” (Oct 2026): https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html
  14. Jason Clinton (@JasonDClinton) on X (Aug 20, 2026): https://x.com/jasondclinton/status/2090543566682718542
  15. Jason Clinton (@JasonDClinton) on X (Oct 22, 2026): https://x.com/jasondclinton/status/2113325263157395456
  16. SANS Institute, “Jason Clinton” profile: https://www.sans.org/profiles/jason-clinton
  17. UK NCSC, Ollie Whitehouse, “Preparing for a ‘vulnerability patch wave’” (May 2026): https://www.ncsc.gov.uk/blogs/prepare-for-vulnerability-patch-wave
  18. Rapid7, “Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days” (2026): https://www.rapid7.com/blog/post/tr-q3-2026-threat-update-attackers-exploiting-vulnerabilities-within-3-days/
  19. AWS Security Blog, “Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot” (Oct 2026): https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
  20. VulnCheck, “State of Exploitation 1H 2026”: https://wwv.vulncheck.com/hubfs/Research/State-of-Exploitation-1H-2026.pdf
  21. UK NCSC, Richard Horne, “Retaining defensive advantage in the age of frontier AI cyber capabilities” (Apr 15, 2026): https://www.ncsc.gov.uk/blogs/retaining-defensive-advantage-in-the-age-of-frontier-ai-cyber-capabilities

More episodes and issues from The Howler at jackallcreative.com/blog. Jackall Creative: jackallcreative.com