Black October: what the AI cyberattack wave means for small businesses

"Black October" is the name that stuck to a burst of security news at the end of October 2026. Within a few days came two critical flaws in PHP, the language behind a large share of the web, found with help from AI models; a state-backed campaign that used AI agents against Microsoft 365 accounts; a run of breaches aimed at stealing AI API keys; and research describing one person's AI agents breaking into websites at more than 100 companies.

It's an informal label, not an official one, and not everything filed under it involved AI. But the thread running through it is real, and it matters for small businesses: AI is making old attacks faster and cheaper to run against everyone at once.

If you only have five minutes

1. Ask whoever hosts your website whether it runs PHP (every WordPress site does), and get written confirmation that it's on a fixed release: 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer, or a vendor build with the fix backported.
2. If your team uses Railway or OpenCode, or installed version 1.107.0 of the LiteLLM library, rotate the passwords and API keys stored there, and revoke AI provider keys at the provider.
3. Review which third-party apps can sign in to your Microsoft 365 or Google Workspace, and remove any you don't recognize.

What happened

PHP2Shell: two critical flaws, found with AI's help

On October 21 the PHP project shipped fixes for two critical flaws, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both let an attacker run their own code on a server with nothing more than a crafted web request; no login needed. They affect any PHP installation that serves web pages, whether through PHP-FPM, Apache's mod_php, or similar setups, and the vulnerable code goes back more than a decade. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get official updates, so sites on those versions depend on their vendor for a backported fix, or need upgrading.

Two research teams found the bugs independently over the summer, and both used AI models to do it: Calif, working under OpenAI's Patch the Planet program, and Wiz, using its own tooling with Gemini and GPT models. Both say a human expert was steering the work.

The fallout moved quickly. Amazon reported exploitation attempts from October 17, days before the official release. Censys counted about 32.5 million internet-facing services on affected versions, which it treats as an upper bound. On October 26, CISA added both flaws to its catalog of vulnerabilities known to be exploited in real attacks.

AI agents doing the break-ins

• Microsoft 365 tenants. Microsoft disclosed on October 21 that Storm-0940, a group it describes as aligned with the Chinese state, took over ConnectWise cloud app identities and used ARTEX, an agentic penetration-testing framework, to attempt sign-ins at more than 2,250 Microsoft 365 tenants. Most attempts failed, but in several cases the group had privileged access in under three hours.
• More than 100 companies' websites. Researchers at NorForge described a campaign in which one operator's AI agents, run through a penetration-testing tool called Cairn, probed more than 1,200 websites and got into sites belonging to more than 100 companies. One researcher's rough estimate put the cost at about $50 of AI usage per successful break-in.
• South Korean financial firms. Earlier in the month, CrowdStrike reported a suspected Chinese-speaking, financially motivated actor using ARTEX, Claude Code and other AI models against South Korean financial firms, with session logs showing a person directing the tools.

Breaches aimed at AI keys

AI provider API keys have become loot worth stealing. A stolen key can run up someone else's bill, and according to two of the affected companies it can also be used to harvest a model's answers to train a rival, a practice called distillation.

• Railway said an attacker pulled encrypted environment variables (the settings where apps keep their passwords and keys) and decrypted some of them, affecting up to 1.85% of workspaces. Its preliminary report says the attacker was after AI provider keys.
• OpenCode said AI provider keys belonging to about 1.4% of its Console users may have been exposed.
• LiteLLM, a popular open-source library for calling AI models, had a malicious release (version 1.107.0) available on PyPI and Docker for about two hours. It stole cloud, Git and AI-tool credentials from the machines that installed it.

How governments responded

CISA, joined by the NSA and partner agencies in the UK, Australia, Canada, New Zealand and the Netherlands, told organizations to patch PHP immediately, starting with internet-facing systems, and to take PHP systems offline if they can't be updated. The EU's cybersecurity bodies issued a joint statement with the same message. India's CERT-In had already warned on October 15 about AI agents being used against Indian systems, and on October 27 the Australian Signals Directorate said more disruption is inevitable.

What Black October wasn't

The label invites exaggeration, so it's worth being precise:

• Not one coordinated attack. It's a cluster of separate incidents by different actors that came to light at roughly the same time. Many had been running for weeks or months before they were disclosed.
• Not all AI. Some of the most disruptive incidents had nothing to do with AI, a Columbia University researcher told Fortune, pointing to the eMudhra certificate failure, which the company blamed on a faulty script. Quest Diagnostics' breach, lumped in on social media, hasn't been tied to AI at all; the company hasn't said how it happened.
• Not instant mass exploitation. Early reports of widespread PHP2Shell compromises were overstated, and several were walked back before CISA confirmed real attacks on October 26.
• Not magic. Many of the techniques were old ones, like SQL injection and malicious file uploads. What changed is the cost of trying them everywhere at once. The PHP researchers also say finding bugs like these still took real expertise.

What it means for a small business

• Being small is no longer cover. When an attacker's AI agents can try a thousand websites for about the price of a dinner per successful break-in, nobody needs to pick you out. You're on the list because you're online.
• The patch window is shrinking. PHP2Shell attempts showed up before the official fix shipped. "We'll get to it next month" is no longer a safe plan for anything that faces the internet.
• Your risk runs through your vendors. Much of Black October reached businesses through software they didn't write: the language their website runs on, a remote-management tool, a hosting platform, an open-source library. Your host, your plugins, your SaaS tools and the AI services your team plugs in all hold keys to your business.
• AI keys are money. A leaked key can be drained or resold. Treat it like a company credit card.

What to do this week

1. Find your PHP. WordPress, WooCommerce, Drupal, Magento and Laravel all run on it, as do many hosted tools. Ask your host or web developer which PHP version each site runs, and get written confirmation that it's patched or that the vendor has backported the fix.
2. Patch, or take it offline. If a site can't be updated, put it in maintenance mode or take it down until it can be. A web application firewall rule buys time, but it isn't a fix.
3. Rotate secrets on affected platforms. If you use Railway or OpenCode, or installed LiteLLM 1.107.0 anywhere, change every password and key stored there, starting with payment, email and cloud accounts.
4. Lock down AI keys. Revoke old keys at the provider, give each project its own key, set spending caps and billing alerts, and keep keys out of shared code and documents.
5. Audit app access to your email and files. In Microsoft 365 or Google Workspace, review which third-party apps have access and remove anything you don't recognize. Microsoft's guidance is to review app sign-ins from October 15 onward, and to save the evidence before deleting anything.
6. Require multi-factor authentication on every admin login, and keep admin panels (hosting control panels, the WordPress dashboard, router consoles) off the open internet wherever you can.

I'll keep tracking the fallout here in AI Threat Watch, a weekly roundup of AI-driven attacks written for small and mid-sized businesses.

Sources

• CISA: Critical vulnerabilities in PHP require immediate patching (Oct 21, 2026, revised Oct 23 and 26) and CISA adds two known exploited vulnerabilities to catalog (Oct 26, 2026)
• The PHP Group: 2026 news archive, release announcements for 8.5.12, 8.4.27, 8.3.36 and 8.2.35
• Calif: PHP2Shell, a tale of two PHP remote vulnerabilities
• Wiz Research: PHP2Shell (Oct 21, 2026)
• TechTarget: PHP2Shell explained: timeline of the global vulnerability crisis (Oct 27, 2026)
• The Register: CISA confirms PHP2Shell under attack (Oct 27, 2026)
• Microsoft Security: AI-driven, large-scale nation-state campaign using ARTEX (Oct 21, 2026)
• The Next Web, relaying Reuters and NorForge: AI agents broke into 100+ sites for one hacker (Oct 19, 2026)
• CrowdStrike: Unknown threat actor uses AI-driven ARTEX to target South Korean finance (Oct 7, 2026)
• Railway: Preliminary report on the October 21 security incident (Oct 22, 2026)
• The Hacker News: OpenCode Console breach may have exposed AI provider keys (Oct 19, 2026)
• Help Net Security: LiteLLM hit by second supply chain attack this year (Oct 22, 2026)
• ENISA: Joint statement on critical PHP vulnerabilities (Oct 21, 2026)
• CERT-In: Advisory CIAD-2026-0049 on AI agents as attack vectors (Oct 15, 2026)
• ABC News (Australia): Disruptions "inevitable" as AI-powered cyber threats grow (Oct 27, 2026)
• Fortune: Cyber expert says companies should face criminal charges amid "Black October" AI hacks (Oct 29, 2026)
• CNBC: AI's "Black October": critical PHP flaws set off global security scramble (Oct 23, 2026)
• SecurityToday: Black October: many attacks had been running for months (Oct 22, 2026)
• BleepingComputer: Mozilla, Google, Apple block compromised eMudhra CA certificates (Oct 20, 2026)
• TechCrunch: Quest Diagnostics confirms patients' data was compromised (Oct 23, 2026)

This post reflects reporting available on November 1, 2026. Details of fast-moving incidents change; check the linked sources for updates.