Truace
Subscribe

‘Black October’: cybersecurity experts sound the alarm over new era of AI-enabled hacking

Leaders in cybersecurity are sounding the alarm after the discovery of a major vulnerability this week. They are predicting that artificial intelligence tools will expose more fundamental weaknesses in global internet infrastructure in the months to come. “I no longer think we’re going to be able to patch all bugs,” said Sam Altman on Thursday evening, joining the chorus of executives. In the midst of what’s being called “Black October”, for which researchers used AI to help identify critical flaws in a coding l…

By the Truvace desk2 min read1 sourceJournalismTRV-2026-2224· cite & verify
‘Black October’: cybersecurity experts sound the alarm over new era of AI-enabled hacking

In brief

Researchers used AI to help find severe flaws in PHP, a programming language behind millions of websites. The vulnerabilities were announced on 21 October 2026, and exploitation attempts began quickly. Some US and UK government and private sites went offline temporarily to apply patches.

The episode matters because technology executives say the same AI capability that finds bugs can help attackers exploit them at greater scale and speed. Their warnings about the coming months and years are predictions, not measured outcomes, so how widely the flaws will actually be exploited remains uncertain.

Main points

  1. The flaws were reported on 21 October 2026 in PHP, a language used across millions of websites.
  2. Some experts estimated that 70% of internet sites were at risk, according to the article.
  3. The US National Security Agency urged every site running PHP to apply patches immediately.
  4. Cloudflare's CEO described exploit attempts rising from thousands to millions after the announcement.
  5. Executives forecast a vulnerability tsunami, but these are forecasts rather than observed results.

The problem

AI-assisted discovery of critical PHP flaws was followed by large-scale exploit attempts, and executives warn defenders may be unable to patch fast enough as AI speeds up both finding and exploiting bugs.

The rundown

The article describes a period dubbed Black October, when researchers used AI to uncover flaws in PHP that may have gone unpatched for years. Wiz researchers called it among the most severe vulnerabilities discovered in PHP. They said the underlying flaws had existed for decades, but exploiting them required a very complex chain of steps at the edge of what human researchers could practically achieve.

After the announcement, government and private websites in the US and UK temporarily took down their sites to patch. The NSA warned that attackers could use the access to steal sensitive data, disrupt services, or move deeper into a network.

Matthew Prince said Cloudflare saw thousands of exploit attempts in the 10 hours before the announcement, tens of thousands within 45 minutes after it, hundreds of thousands within 2 hours, and millions by the time of writing. Sam Altman, Jason Clinton, Marc Benioff, and Prince warned that patching may not keep pace with AI-driven discovery.

Sources

  1. JournalismThe Guardian2026-10-23

The debate