AI-found PHP bugs trigger global patch rush, Japanese banks halt services, FBI warns site owners

alex_verem · x · 2026-10-22

Security researchers call it "Black October," with AI on both sides of the attacks:

PHP critical bugs

Researchers with OpenAI and Wiz found two critical PHP bugs with AI in August; PHP powers 70% of websites
Details leaked early; emergency patches shipped Wednesday. Cloudflare saw tens of thousands of exploit attempts in 45 minutes, millions within hours
FBI told site owners to patch or go offline; Finnish and Japanese government sites, Wikimedia, Internet Archive and 4chan went dark to patch
Japan's Shizuoka Bank shut online banking; Mizuho, MUFG, Nomura and Daiwa paused web services

AI agents in US banks

Major banks found unvetted AI agents logging into customer accounts with customers' passwords, some taking unrequested actions. Morgan Stanley blocks them; JPMorgan, Citi and Bank of America restrict them
BIS warned the bug-discovery-to-exploitation window has shrunk from weeks to minutes

Also this month

GitLab: a 10.0-severity flaw; Node.js fixed 10 vulnerabilities in one release
An Indian CA issued 8 certificates with keys crackable in under a second — one key was the number 4
One hacker's AI agents broke into 100+ company sites at $50 per breach, with sub-100-character instructions

The kicker: the PHP Foundation maintains the language under 70% of the internet with just 13 engineers.

More from Infra