Calm down. · Builders

Calm down: Black October is just a patch week with a press agent.

By alkizz · Oct 25, 2026

The PHP bugs are real, and our PHP brief is still a 5. What Friday's coverage added is a name. CNBC says the moment is "being described as 'Black October'" and that "some have dubbed" it that. The Guardian calls it "what's being called 'Black October'." Neither says who's calling it that. Calm down.

Here's the soundtrack the coverage quotes. Per the Guardian, Sam Altman said "I no longer think we're going to be able to patch all bugs." Anthropic's deputy CISO Jason Clinton predicts a "vulnerability tsunami" and says "There won't be enough time to patch critical infrastructure." Salesforce's Marc Benioff called it a "code red." Cloudflare's Matthew Prince says "It's going to feel like the sky is falling." CNBC quotes an X post from Figma's senior director of product management saying several dozen attacks in two days "would each have been the worst to happen in an entire calendar year." CNBC doesn't verify that claim, and I can't either. The reporters aren't the problem. The people were having a week.

Now read the same stories for what those people tell you to do. Clinton, as quoted by CNBC: "please go to your boards and ask for help right now." Then: "Not for ai, for the basics." Former CISA director Chris Krebs told CNBC that smaller companies should "constantly" scan for vulnerabilities, deploy patches as fast as possible, or take legacy systems offline. The Figma director's list is two-factor authentication, a password manager, an identity protection app, and smart devices on their own network. That's not a new era. That's the checklist you already had, read aloud with the lights off.

Yes, there's an AI attacker in this story, and yes, it's real. Unit 42 updated its PHP2Shell threat brief on Oct 23: attackers using "agentic AI attack platforms" for post-exploitation hit a European government entity. Within two hours of initial exploitation, they had password hashes and MFA secrets. They also set up an NTLM-relay tunnel into Active Directory and attempted Domain Admin escalation. Unit 42's evidence that a model was driving: command batches wrapped in delimiters like ==SHELLUSER== and ==PASSWD==, which "produce machine-parseable output for an AI model to read," plus short, serially spaced tasks and quick pivots after failures. So yes, it's real, and yes, patch.

But look at what it ran: recon commands through a web shell on a box that was exploitable. My take: an agentic attacker is a faster script that formats its output for its reader. Faster matters. Two hours from foothold to MFA secrets is not much time to notice. But it doesn't change the job: don't be exploitable when it shows up, and assume anything it could read is gone. Unit 42's Xpanse counts "over 22.6 million exposed instances potentially vulnerable." "Potentially" is doing real work in that sentence. Your number is the count of your own hosts that aren't patched yet.

Hold the label to the same standard as a PoC. A scary name isn't evidence and it isn't a fix. Your score comes from your exposure, not from the month.

What to do:

• Do the PHP brief's to-do list. Patch, restart workers, rebuild images, confirm the version you actually run. It's all in the brief.
• Rotate what the attacker went for. If a PHP host was reachable before you patched, treat secrets the web user could read as exposed. Unit 42's case went straight for password hashes and MFA secrets, so a password reset alone isn't enough there. Re-enroll MFA for any account whose secrets lived where the attacker could reach them.
• Incident response, using Unit 42's write-up and hunting query:
  • Preserve web server, PHP and endpoint logs before you rebuild anything.
  • Look for shells and recon tools (whoami, id, uname, cat /etc/passwd) spawned by PHP workers (php-fpm, apache2, httpd, frankenphp, lsphp) or running as the web service account.
  • Search command lines and web shell output for section-header delimiters like ==SHELLUSER== and ==PASSWD==.
  • Check for new authentication from web hosts into Active Directory, the NTLM-relay path Unit 42 describes.
• Ignore the vibes. A scary name isn't on any checklist. "Patched by Monday" is.

Sources

• Beazley Security Labs, BSL-A1233: PHP2SHELL: Critical PHP RCE Flaws Threaten Web Infrastructure Amid Active Exploitation (updated Oct 25, 2026)
• CNBC: AI's 'Black October': Critical PHP flaws set off global security scramble (Oct 23, 2026)
• The Guardian: 'Black October': cybersecurity experts sound the alarm over new era of AI-enabled hacking (Oct 23, 2026)
• Unit 42: Threat Brief, Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (updated Oct 23, 2026)
• Dumb But Secure: Critical PHP Security Release: Patch, Rebuild, Skip the PoCs

← All briefs