Was this year’s cybersecurity October surprise a shock to the system or overblown?
Dubbed “Black October,” the month saw several vulnerability and bug disclosures that sent concerns rippling through the cybersecurity community. The most significant announcements over those 31 days were a pair of critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, discovered in PHP, the open-source scripting language that reportedly runs about 70 percent of the web.
These critical remote code execution (RCE) vulnerabilities each have a CVSS rating of 9.2. Researchers at Palo Alto Networks Unit 42 initially uncovered about 22.6 million exposed instances potentially vulnerable to these PHP2Shell flaws.
Another notable part of these disclosures is that researchers with Palo Alto Networks and others used OpenAI’s GPT-5.6 Sol, an advanced large language model designed to help solve complex mathematical, computational and cybersecurity problems, to uncover these flaws.
Following those initial disclosures, other cybersecurity researchers began to point out the severity of these vulnerabilities, especially since they affect PHP code that is widely used across websites operated by private enterprises and government agencies. For example, Wiz researchers pointed out that flaws in the core PHP engine were comparable to what happened when the Heartbleed vulnerability was first disclosed in 2014.
In its announcement, OpenAI also noted the severity of the two PHP flaws, as well as the role the latest artificial intelligence technologies played in uncovering them: “Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.”
Once researchers published these disclosures, government agencies, including the U.S. Cybersecurity and Infrastructure Security Agency (CISA), issued warnings to federal agencies and private firms to fix their PHP code or take websites down until they could apply patches.
Within a week, however, expectations of a wave of attacks associated with these PHP vulnerabilities began to subside. Recorded Future reported that while attackers tried to actively exploit the PHP code flaws, large-scale attacks did not materialize.
Independent security researcher Marcus Hutchins noted on LinkedIn that concerns about a cybersecurity Black October had been overblown. “A bunch of vulnerabilities were found, responsibly disclosed, and fixed. There has been no major exploitation or damages,” he wrote.
Still, the significance of October's disclosures extends beyond the immediate threat posed by the PHP vulnerabilities. Taken together, these incidents demonstrate how AI is changing the cybersecurity landscape by accelerating the discovery of software flaws and potentially shortening the time organizations have to address them. The same technologies that help researchers identify vulnerabilities can also help attackers develop exploits and move more quickly than traditional security defenses can respond.
“AI helped researchers find critical remote code execution flaws in PHP. That’s code that runs most of the web, and the bug traces back to 2004. Exploit work that once took a team months took one researcher about a week,” Niv Braun, CEO and co-founder at New York City-based Noma Security, told Dice. “Attackers were probing the flaws before the official patch even shipped. Days after the PHP disclosure, a Node.js flaw [another remote execution flaw disclosed Oct. 21] had a public proof of concept within a day of the fix. That’s the new clock. AI finds old bugs faster than humans can patch them, and agents will exploit them faster than humans can respond.”
AI Expands the Attack Surface, Accelerates Risk
While cybersecurity has always been asymmetrical in nature – attackers have to be right only once, while defenders must be right all the time – AI makes that reality much riskier and more immediate for many security organizations by expanding the attack surface. This includes standard IT systems and networks, as well as operational technology (OT) and IoT devices, said John Gallagher, vice president at security firm Viakoo.
“A defender using AI must scan, analyze, and successfully patch millions of distributed systems across cloud, enterprise IT, and OT and IoT devices. An attacker with AI only needs to find one unpatched runtime to gain code execution,” Gallagher told Dice.
Other experts noted that AI is rapidly increasing vulnerability disclosures and changing the nature of when and how fast flaws are published, as well as the speed at which attackers are able to exploit them. And the challenge extends well beyond old, flawed PHP code.
“Security teams have long assumed old code and dependencies hide serious flaws. This is proof. This isn’t just a PHP issue. Every framework and open-source library has flaws buried inside. More eyes and more varied expertise will bring them to light, and AI will speed that up,” Trey Ford, chief strategy and trust officer at Bugcrowd, told Dice. “It will be uncomfortable until we reach a new level of confidence in our software. Meanwhile, the industry has tested its deployments, planned for how things fail, and built layers of security to limit the damage from flaws we haven’t found yet.”
Tim Mackey, head of software supply chain risk strategy at Black Duck, noted that for many cybersecurity professionals, AI is changing how they have to approach their jobs, whether that involves understanding and acting on vulnerability disclosures or assessing risk and determining how best to approach patch management in response to these disclosures.
“When a leak, or advance knowledge, of a vulnerability occurs the whole ecosystem surrounding the vulnerability is put at risk. As details of the leak are published, security defenders are faced with the real risk that malicious actors could use the absence of an official patch to supply their own malicious patches,” Mackey told Dice. “Security teams should pay extra attention to the origin of their patches and validate functional changes against official release notes. After all, a malicious patch might implant a backdoor for future use and a rush to patch could present the right opportunity for malicious actors.”
Adapting to an AI-Driven Threat Landscape
What the PHP and other vulnerabilities published and disclosed in October show is that the job of cybersecurity is changing – both in how security practitioners approach their jobs and in the types of risks organizations face as AI adoption continues.
For Gallagher, it means that cybersecurity professionals cannot ignore the use of AI-infused security tools to help them do their jobs and keep up with attackers who can access many of the same technologies. These tools can help security teams identify vulnerabilities, continuously monitor systems, prioritize patching based on risk and automate remediation where appropriate. Without these capabilities, defenders may struggle to keep pace with the speed at which attackers can identify and exploit weaknesses.
“You can't defend against machine-speed attacks with human-speed approaches,” Gallagher added. “For IT systems with automated update mechanisms the most optimistic view would be ‘just barely,’ especially if attackers can weaponize an exploit before a patch can be issued.”
Organizations, whether in the private sector or at government agencies at the local, state or federal level, must also make similar decisions about risk tolerance and what it will take to address vulnerabilities and accelerated disclosures. These decisions should involve business units, with input from cybersecurity leaders and their teams.
“When we learn of a vulnerability, the business must decide: take the system offline or accept the risk and race to patch before something goes wrong. The vulnerability response window keeps shrinking because attackers now move at machine speed to exploit these flaws,” Bugcrowd’s Ford noted. “This isn’t only the security executive’s call. The risk committee informs the business decision. Disclosure won’t always be coordinated, and we can’t count on friendly researchers finding flaws first. We are racing an adversary who is trying to exploit them.”
