They found it first

On the first of August, two days after his firm joined OpenAI's Patch the Planet programme, a researcher at the security company Calif called Ryan Austin pointed GPT-5.6 Sol at the core of PHP and came back with ways to run code on a server without logging in. PHP isn't glamorous. Hardly anyone starts a new project in it, and it never comes up when people talk about modern software. It also runs something like seven in every ten websites whose server language you can identify, including every WordPress site, Drupal, Joomla and the MediaWiki under Wikipedia. Later that month the team at Wiz found the same family of bugs on their own, using their own agent alongside Gemini 4 Argon and the same OpenAI model. OpenAI found it too. Three separate groups walked up to the same door within a few weeks of each other.

The flaws themselves weren't new. Both are use-after-free bugs, the kind where a program goes on trusting a piece of memory it has already given back, and the vulnerable code goes back to PHP 5.4, released in 2012. People had noticed the underlying weakness before, and a related exploit was theorized in 2024, and nobody turned it into a working attack, because doing so meant chaining together a run of fiddly steps that Wiz describes as "at the edge of what human researchers could practically achieve". That phrase is the whole story, really. The bug sat there for a decade because exploiting it was too hard to be worth anyone's while. The models made it easy enough. In Wiz's words, a single researcher with frontier models "completed in a week what previously would have taken a world-class team months of work."

The slow part was the people

Here is what I keep coming back to. The finding took days. Everything after it took two months, and that's not a criticism, because the two months were spent doing the right things.

The first report reached PHP on 11 August, and PHP confirmed Calif's proof of concept in mid-August. From there OpenAI ran what it now describes as a five-stage process. Fix the bug upstream, and point frontier models at the patch to look for ways round it. Quietly give the distributors, hosting firms and security vendors time to get ready. Bring in governments, which for PHP meant the White House's Super Intelligence Force, the Office of the National Cyber Director and CISA, plus partners abroad. Widen the circle as the fix settles. Then publish. Cloudflare had firewall rules running before anyone outside knew. Wiz lists Google Cloud, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva and Vercel among the companies it worked with ahead of time. By the standards of how this has gone in the past, it was a careful, generous, grown-up piece of work.

And it leaked anyway. On 20 October the CVE numbers began circulating online, some of the mitigation advice given to critical infrastructure providers got out, watchTowr confirmed the remote code execution was real, and a video of a working exploit went up early by mistake. PHP pulled its release forward and shipped fixes for 8.2, 8.3, 8.4 and 8.5 at 3pm London time on Wednesday 21 October. Cloudflare says it saw attack attempts from 8:43am that morning. Amazon's threat intelligence team went further on Wednesday and said its honeypots had caught an attempt on Saturday 17 October, four days before the patch, from an anonymised address. It says it doesn't know how the attacker got the information, or whether those attempts would have worked. In the first hour or so after the release, the monitoring service mySites.guru found that only 0.08 per cent of the sites it tracks were on a fixed version.

That's the shape of the problem OpenAI is honest about in its own post. The window defenders have, it says, "may be in short supply if frontier capabilities are not too far ahead of those that are broadly available." Every extra group that finds the same bug is another person who could leak it, and another chance that someone who isn't telling anyone already has it. When three teams can find a flaw more than a decade old in a month, you have to assume a fourth did too.

Then there's the patch itself. In open source a fix is a map of the bug: anyone can compare the old code with the new and see exactly what changed. That used to take a skilled person a few days, and now a model can do it while you make a cup of tea. Sansec, the Dutch e-commerce security firm, expected mass exploitation within a quarter of an hour of the release. So the race now isn't really between finders and attackers. It's between the attackers and the long, unglamorous chain of hosting companies, Linux distributions, container images and small businesses with a site somebody's nephew set up in 2017, all of which have to actually install the thing. About a third of PHP sites are still on version 7 or older, which gets no official fix at all.

It wasn't as bad as the headlines, and that's not the point

I want to be fair here, because the panic ran ahead of the evidence. Several public bodies took services offline on Wednesday as a precaution, including the Dutch DigiD login, Tweakers, the Dutch House of Representatives, the Dutch NCSC and Security.NL. By Thursday Sansec had revised its view: the public exploits don't work against a default PHP setup, most need the target to already have a serious bug of its own, and nobody has shown a single request that works everywhere the way Log4Shell did. Amazon says exploitation attempts are now broad but it doesn't know how many succeed. Governments and security agencies still urged organisations to patch now, and the honest position is somewhere between those. Patch, and don't believe the screenshots of half the internet on fire.

But "it turned out to be harder to exploit than we feared" is a much thinner comfort than it sounds, because the thing that made it hard was exactly the thing the models are good at removing. Wiz put it plainly: language models "can help adapt an exploit to different PHP versions, configurations and memory layouts." The barrier that saved us this week is a barrier made of fiddliness, and fiddliness is what's getting cheap.

The other side had agents too

The reason this week has a name, Black October, is that PHP2Shell didn't arrive alone. The same few days brought a critical GitLab flaw going back to 2014, a batch of Node.js fixes, a certificate authority in India whose signing keys were so weak that one of them was the number 4, and breaches at the hosting platforms Railway and Zeabur that exposed the stored secrets customers use to connect to their databases and AI providers. Zeabur is shutting down by the end of the year.

Two stories in that pile are about AI on the attacking side, and they're the ones I'd read twice. On Monday, Reuters' Raphael Satter reported on research by Snorre Fagerland at NorForge, who found about two dozen control panels for an open-source agent platform called Cairn sitting exposed on the internet and was able to watch the people using them. The busiest, a Chinese-speaking operator, had been feeding instructions of fewer than a hundred Chinese characters into a pipeline that set agents on online shops in the US, Canada, Australia and Japan, with the job of finding a way to run code without logging in and leaving a web shell behind. The agents tried more than 1,200 sites and got into those of more than 100 companies, including Deere, SharkNinja and a vendor site for Cummins. A successful break-in took about 23 hours of the agents poking around. Fagerland reckoned the whole campaign, which seemed to use a mix of DeepSeek and Claude Code, cost about $5,000 in tokens, or roughly $50 a hack. Deere says no sensitive information was accessed and SharkNinja says the site was a standalone support page, so this was not a catastrophe, and Reuters says it could not ascertain whether any data was taken. What changed was the labour. One person, a short prompt and a few thousand dollars did what used to need a crew.

The second is subtler, and I think it matters more for anyone who builds with these tools. LiteLLM, a popular open-source gateway that sits between apps and the model providers, had a poisoned release on PyPI and Docker Hub for about two hours on Wednesday lunchtime, carrying a stealer that grabbed cloud keys, SSH keys, CI tokens and AI provider keys from any machine that ran it. LiteLLM's own write-up is unusually candid about how. An attacker got into an internal LiteLLM deployment that was exposed to the internet. LiteLLM suspects a recently patched vulnerability but hasn't confirmed how they got in. In its logs the attacker found GitHub tokens belonging to three developers. LiteLLM believes they were there because, as it puts it, "we have observed specific situations in which Claude Code will embed a user's GitHub CLI OAuth token into a response body", and the gateway was logging response bodies. One of the tokens belonged to an owner of the GitHub organisation, which was enough to switch off branch protection and push a release built from a lookalike repository. The company had hardened its release process after an earlier incident in March, and it was undone, LiteLLM believes, by a credential its own coding assistant had written into a log.

Nobody did anything outlandish there. A coding agent did something slightly careless with a secret, a logging setting did what logging settings do, and an internal server was exposed to the internet. Each of those is ordinary. Strung together they're a supply-chain attack on a library thousands of AI apps depend on. Railway, for its part, says its breach was one of a series aimed at platform companies as a route to AI inference providers, and OpenCode linked the theft of its users' provider keys to "a large-scale distillation attack". The AI layer isn't only a tool for attackers now. It's what they're after.

What I take from it

I don't read this week as an argument against using AI for security. The opposite, mostly. The models found PHP2Shell before, as far as anyone knows, a criminal did, and the response was led by maintainers, security firms, a lab and governments working together for two months, which is about as good as this gets. OpenAI's framework is worth reading, and it's refreshing that it ends with a list of questions rather than answers, including an uncomfortable one about whether governments should ever use a flaw to patch systems whose owners have lost control of them. It has also put up a billion dollars of subsidised access for under-resourced defenders, and said it expects findings like this to "increase sharply in the coming months".

That last line is the one to sit with. If finding is getting cheap and exploiting is getting cheap, the only part of the system that isn't getting faster is the part made of people: the maintainer reading the report, the host scheduling the upgrade, the small charity that doesn't know what PHP is. Disclosure plans built for months of quiet don't fit a world where three teams find the same bug in a month and a patch can be read in minutes. Patching is the bottleneck now, and patching mostly isn't an AI problem.

The same week, Anthropic previewed Claude Duet, in a research preview on a US waitlist, an agent that keeps watch on your apps and sends a morning brief while you're away, and said new sessions in most Claude apps on Pro, Max and Team will run in auto mode by default from next week, with an automated check standing in for the human clicking approve. Both come with sensible guardrails, and I'm not suggesting they're reckless. But it's worth noticing the direction. We are handing agents more standing access to more of our accounts at exactly the moment the people breaking in have started stealing the keys those agents hold, and reading the logs they leave behind. The lesson of Black October isn't that the machines are winning. It's that they're very fast at both ends of the problem, and very slow in the middle, where we are.