AI-Powered Hacking Finds PHP2Shell and More; Infosec Braces for 'Black October'
404 Media · rss · 2026-10-22
404 Media surveys how AI is upending both offensive and defensive security. After Wiz, Calif and OpenAI researchers used AI to uncover the internet-wide PHP2Shell vulnerabilities, a wave of issues hit eMudhra, Node.js, GitLab, Plex, Railway and OpenCode, prompting some infosec figures to call it "Black October."
Key facts:
- Cloudflare CEO Matthew Prince: thousands of exploit attempts in the 10 hours before disclosure, tens of thousands within 45 minutes after, hundreds of thousands in 2 hours, millions now.
- Johns Hopkins cryptographer Matthew Green warned the internet is "dry tinder"; some AI employees went full prepper, urging cash, gold and stockpiles.
- Chainguard was criticized for shipping fixes hours before the embargo lifted; its CEO says a frontier model found the same bugs from a plain-language prompt, raising uncomfortable questions about how findable the bugs really are.
- The NSA, Japan's PM and other governments urged immediate patching; 4chan, some Wikimedia services and Archive.org went briefly offline to update.
The core argument: AI hasn't gone rogue—it has simply made brute-forcing the whole internet trivially easy, and much of the world's software was never secure to begin with. OpenAI frames its research as opening a "Defender's Window" for defenders, but AI is compressing every stage of the disclose-and-patch cycle. A lingering risk: legacy sites that can't be patched may be pulled offline or breached and never return, with severe link rot and loss of internet history.
More from Safety
- Sanders calls to pause autonomous AI agents in bank accounts; critics push back — AIandDesign · 2026-10-23
- TechPolicy essay: system prompts are weak evidence of AI safety, outputs must be evaluated — mmitchell_ai · 2026-10-23
- Anthropic's deputy security chief warns cyber threats will get 'a lot worse before they get better' — Polymarket · 2026-10-23
- AI cyberattacks could paradoxically accelerate AI development in an offense-defense arms race — kimmonismus · 2026-10-23
- AI Now's People's AI Assembly spotlights data center opposition and labor rights — AINowInstitute · 2026-10-23
- Cloudflare CEO: Next two years of AI cyberattacks will be terrifying but make the internet more secure — johncoogan · 2026-10-23