SpaceRock

Black October: 4 Security Flaws That Exposed the Internet

By Veer Solanki · · 1573 words

Topics: AI, Account Security, Agentic AI, AI Agent Security, AI Agents, AI Agents in Banking, AI and Cybercrime, AI API Security

Black October: 4 Security Flaws That Exposed the Internet

In four short days, the internet has discovered what happens when machines become as good at finding vulnerabilities as the best humans in the world.

October is Cybersecurity Awareness Month, but 2026 had its own twist. A series of vulnerabilities revealed between 17th and 22nd October saw the term ‘Black October’ coined.

A vulnerability within the PHP language (which makes up ~70% of the web) caused Governments to scramble to take their sites offline. An open-source AI gateway released malware through its official distribution. An Indian certificate authority had keys of such low strength that one was reported to be the number 4, and US Banks reported finding AI agents in their customers’ accounts.

Whilst these are nothing new – memory errors, poisoned packages, poor crypto and credential leaks are amongst the oldest stories in security – AI models are uncovering decades-old bugs faster than we can patch. Attackers have access to the same tools.

PHP2Shell

Black October: 4 Security Flaws That Exposed the Internet

The core issue is a critical remote code execution vulnerability within PHP itself (CVE-2026-109618 and CVE-2026-109619). These have a severity score of 9.2/10. The first vulnerability is a use-after-free vulnerability within PHP’s upload progress functionality. The second vulnerability is a memory corruption caused when PHP runs out of memory during a request.

These are particularly nasty as they occur during parsing of an inbound form upload. This means only one unauthenticated request is required. This isn’t an issue with a WordPress plugin that can be updated. It’s within the core engine and reportedly dates back to PHP 5.4 (around 14 years).

This was found by researchers from Wiz, Calif., OpenAI and Quarkslab. Much of this was uncovered using frontier AI models. Details were leaked, and exploitation occurred.

Operators went on high alert and took the following actions:

The PHP project released urgent updates to versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on the 21st. There is no official fix for versions 8.1 and below. Patching was slow. Ox Security reported that around 99% of identifiable impacted hosts were still unpatched a day later. Attempts to exploit the vulnerability increased to millions.

Supply Chain Issues

Whilst PHP was having a busy day, AI developers were also targeted.

LiteLLM, an open-source gateway many teams use to manage calls between OpenAI, Anthropic, Google and others, had its distribution compromised. On the 21st, attackers used stolen GitHub credentials from 3 developer accounts, targeted a spoof repository and distributed version 1.107.0 via PyPI, Docker Hub and GHCR.

This was live for a period of ~2-3 hours. The package contained a credential stealer that stole SSH Keys, Cloud credentials, CI secrets and all LLM provider keys within the proxy database. It also contained a backdoor that contacted the attacker once every hour. It executed on all Python startups, even if the package wasn’t imported. This was the second supply chain compromise for the project this year. The secure version is 1.106.2. All users of 1.107.0 should assume all assets accessible from the machine are compromised.

How the GitHub credentials leaked is still being investigated. LiteLLM’s team highlighted that an AI coding agent had echoed credentials from GitHub in some cases. These may have been logged by internal systems, but it isn’t confirmed that this was the entry point.

Other companies were impacted:

Platforms with AI API keys are now some of the most valuable targets on the internet.

eMudhra – Private Key = 4

Black October: 4 Security Flaws That Exposed the Internet

Certificates are handled by certificate authorities. On the 17th, a researcher known as Wayne found that 8 intermediate CA keys from eMudhra (Bengaluru-based, listed on the Mumbai stock exchange) could be recovered from their public certificate. One of the keys was literally the number 4 (The Register).

Anyone with access to these keys could have issued trusted certificates from browsers to any domain. This would have allowed them to create a perfect phishing site for your bank.

The root cause of this was a key ceremony on 30th April 2025. During this process, a wrap/unwrap caused a second set of weak keys to be generated. The staff then published the weak keys. These were then included in browser trust stores for ~18 months.

The response was quick:

No AI villains here. Just a reminder that the internet can be vulnerable due to one bad day.

AI agents in your bank account

The most bizarre story of the week didn’t involve hackers. On the 22nd, Axios reported that major US banks, including JPMorgan Chase, Bank of America, Wells Fargo and Morgan Stanley, are detecting third-party AI agents within customer accounts. Some were trying to do things beyond what the user requested. Reuters independently confirmed that banks were blocking these agents.

The issue is simple. Users provide their banking login to an AI agent to check their balance or transfer money. The AI agent logs in as them and doesn’t have any of the checks in place for third-party access. JPMorgan’s Jamie Dimon already labelled external agents as a significant risk during their earnings call on 13th October.

The following points should be noted:

This is less of a Skynet scenario and more of a permissions issue. Banking systems are designed for humans and authorised applications. AI agents aren’t either. There hasn’t been agreement on how these should operate.

What changed?

Putting aside the panic, Black October has shown us 4 classic issues but at scale.

Bug hunting is now cheap. Using frontier models, large open-source codebases can be scanned for vulnerabilities that have been sitting undetected for over a decade. One estimate suggests around 3% of all critical security bugs ever recorded were found in October alone. This was mostly due to AI-driven scanning (Andrew Yang’s newsletter). OpenAI have admitted they can be used to quickly develop attack tools.

Attackers can exploit them cheaply. One security writer reported the total cost of the campaign to be around $5,000, or roughly $50 per successful breach. CrowdStrike reported 4 operators running campaigns using AI agents. One targeted at least 15 Argentinian healthcare organisations.

Time to patch has decreased. Large public exploits are usually weaponised within 24-48 hours. PHP2Shell was being exploited before a patch existed. You won’t have a week’s grace period to patch.

Too much access. Whether it’s LiteLLM keys or bank logins, the commonality is that the software shouldn’t have access to credentials.

Markets took notice. Tech stocks fell as people reassessed the risks associated with AI.

What to do now

If you develop or run anything:

If you’re just a user:

The Cost

The sad truth is that the AI didn’t create these vulnerabilities. The PHP vulnerabilities were written years ago by humans. The weak keys were published by humans. The passwords were given away by humans. The AI just highlighted that they exist and were accessible to both defenders and attackers.

That’s the new normal. The bugs were always there. Now someone, or something, is actually looking. The only real question left is who finds them first.

Add SpaceRock as a preferred source on Google