Get started

Black October: a PHP flaw, hackers with Claude Code and 9 more incidents

Author
Viner Shakirov
Oct 22, 2026
Reading time: 17 min
News & releases
Black October: a PHP flaw, hackers with Claude Code and 9 more incidents

Between October 12 and 22 there were at least 11 serious breaches, leaks and dangerous vulnerabilities, and AI models were involved in seven of them one way or another. On October 21, PHP shipped emergency patches for two flaws - according to OpenAI, one of them was found with GPT-5.6 Sol - and attacks on it started before the fix was out. Social media has already dubbed it "Black October", and many posts claim swarms of autonomous agents are behind all of it.

Below we go through it in order: what happened, where AI actually played a role, and where the breach happened the old-fashioned way - because of a password stored in plain text.

Timeline of the ten days

DateWhoWhat happenedAI involved?
Oct 12-13French supermarketsHackers overheated refrigerators in hundreds of storesNo data
Oct 14-15Zeabur3.2 million records with customer environment variables were readNo
Oct 15-16ConnectWiseAttackers used a stolen backup-service key to get into customers' Microsoft 365Yes, according to the company
Oct 15-16Burger King Japan11.18 million app user records leakedNo
Oct 16-17OpenCodeOpenAI, Anthropic and Google keys may have leaked, users report chargesAI keys leaked
Oct 19100+ companies, including John DeereOne hacker breached websites with an army of AI agentsYes
Oct 21PHPTwo critical flaws, one found with GPT-5.6 SolYes, in discovery
Oct 21LiteLLMA release with malicious code was available for two hoursAI keys stolen
Oct 21RailwaySuspected access to customer secrets, deploys pausedAI keys leaked
Oct 21GitLabA 10-out-of-10 flaw in code dating back to 2014No
Oct 21CrowdStrikeReport on four groups that breached companies through Claude CodeYes

AI finds holes faster than they can be patched

Let's start with two vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619. Both let an attacker run their own code on a server without a login or password, and both scored 9.2 out of 10 on the CVSS scale. Cloudflare says servers running PHP 5.4 and later are vulnerable - practically everything that has run on PHP for the past decade or more. OpenAI puts the scale this way: "Given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues".

Several teams found the problem. According to the PHP Foundation, a researcher from Calif and OpenAI reported it independently on August 11, and Wiz did on August 24. OpenAI says Calif found a critical flaw using GPT-5.6 Sol as part of its Patch the Planet program, but doesn't say which of the two. Calif's own write-up doesn't name the model and says it used only publicly available models without a special harness.

Then the disclosure went sideways. The patches were planned for October 22, but on the 20th the CVE numbers leaked, Calif accidentally published a proof-of-concept video, and a container vendor released patched images ahead of schedule. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped on October 21 at 14:00 UTC, almost a day early.

Cloudflare CEO Matthew Prince shared numbers from his network: thousands of exploitation attempts in the 10 hours before the announcement, tens of thousands 45 minutes after, hundreds of thousands after 2 hours, and millions by the time of his post. An important detail from Cloudflare itself: the flaw is in the PHP runtime, so updating your website or plugins isn't enough - you have to update PHP itself.

Chart of PHP2Shell exploitation attempts on the Cloudflare network: thousands in the 10 hours before disclosure, tens of thousands 45 minutes after, hundreds of thousands after 2 hours, millions by the time of Matthew Prince's post

There's a flip side. The PHP Foundation says it has published 15 CVEs since July 1, but in the same period handled more than a hundred reports that turned out to be invalid, duplicates or not reproducible. Tools find bugs faster than ever, "for defenders and attackers alike", but a person still makes the call on every report.

For contrast: the same day, GitLab fixed CVE-2026-110264 with the maximum score of 10. The bug in regular expression handling goes back to version 7.0 from 2014. It was found by researcher joaxcar through HackerOne - and no neural network is mentioned anywhere in this story.

Hackers with an army of AI agents

On October 19, Reuters reported on a Chinese-speaking hacker who, starting September 25, set AI agents on more than 1,200 websites in the US, Canada, Australia and Japan and breached more than a hundred. On average a breach took about 23 hours, and the agents ran on DeepSeek and Claude Code. NorForge researcher Snorre Fagerland estimates the tokens for the whole campaign cost about $5,000, or roughly $50 per successful breach. The agents did almost all the work themselves on the open-source Cairn platform.

The victims include John Deere, SharkNinja and Cummins. Deere says it sees no sign that sensitive information was accessed, SharkNinja says a standalone support site was hit and the incident was contained, and Cummins is looking into a site run by a third-party vendor. The way the campaign was found is almost funny: the operators left their Cairn control panels open on the internet, and the researcher simply came across them while scanning.

On October 21, CrowdStrike published a report on four previously unknown groups that breached companies with AI agents between May and August. They too were given away by carelessness: they kept their frameworks in open directories on their servers. All four were built on Claude Code with a pentesting harness - that is, set up as a legitimate, commissioned security test. Under that cover story, the model executes the commands.

  • A Spanish- and English-speaking operator breached at least 15 healthcare organizations in Argentina and took credentials and medical records from one of them. His system has two agents: a "supervisor" on Claude Code picks the next attack step, and an "executor" carries it out.
  • A Chinese-speaking group worked through 20-plus targets, including government bodies in two countries, and accessed Claude models through a Chinese proxy service.
  • An Indonesian group, the least sophisticated of the four, simply downloaded 819 ready-made Claude Code skills from GitHub, told the model to compromise its targets and nudged it by hand whenever it hit safety guardrails.
  • The fourth group launched a seven-step scenario, from reconnaissance to data exfiltration, with a single command. Its victims include a US CRM vendor.

According to CrowdStrike, agents reach their objectives "at machine speed, often within an hour". And over the next 12 months, low-skill hackers will be able to run campaigns at a scale previously within reach only of organized criminal groups and state-linked actors.

A similar story played out a little earlier in South Korea. On October 1, Shinhan Bank announced a leak of data on about 25,000 customers: names, phone numbers, income and credit limits. The next day Korean media linked the bank attacks to ARTEX, an open-source AI pentesting tool. On October 7, CrowdStrike published an analysis of ARTEX attacks on the Korean financial sector: the attacker's main model was DeepSeek, with Claude Code running in parallel. CrowdStrike doesn't name Shinhan itself, and the link rests on matching targets. On October 8, the ARTEX developer announced they were closing the code and ending updates.

AI keys are leaking through developer services

The second thread of Black October affects everyone who connects ChatGPT, Claude or Gemini to their projects with an API key. A key is a password the provider uses to bill you for requests. And in one week, such keys may have leaked from four platforms at once.

Four-step diagram: you store an API key in a third-party service, the key gets stolen, an attacker runs models at your expense, the bill comes to you. Below - what breaks the chain: a separate key, a spending limit, revoking the key

OpenCode. On the night of October 16, an intruder got into a legacy system of OpenCode's cloud console, where users stored OpenAI, Anthropic and Google keys. 1.4% of console users were affected. According to co-founder Dax Raad, keys that the CLI and desktop app store locally were not affected. Users describe charges: one counted $281 at OpenAI and $168 at Anthropic, another about $1,700 in losses.

LiteLLM. This library is used to call different models through one interface, and it gets about 23 million downloads a week. On October 21 at 11:39 UTC, version 1.107.0 appeared on PyPI with a trojan: it collected cloud credentials, GitHub and npm tokens, .env files, LLM keys, Claude, Codex and Cursor sessions, and browser passwords. The same images spread through Docker. The version was pulled two hours later. It was published using GitHub CLI OAuth tokens stolen from three engineers.

Railway. On October 21, the hosting platform reported "anomalous activity" in the systems that store customer environment variables. Railway paused all builds and deploys and asked the providers those customer keys point to to revoke them proactively. The company itself sees this as one of a series of attacks on platforms aimed at getting access to AI providers. Railway hasn't said how many customers were affected. By the morning of October 22, builds were back for Pro and Enterprise plans, and all Railway API tokens had been revoked.

Zeabur. For this platform, it's the second breach in two months: on October 14-15, an attacker read 3,218,965 environment variable records and 321,810 account records. On October 17, the founder announced the service is shutting down, with all servers stopping on December 31.

What else happened these days

Not every incident of these days is about AI. In two of them neural networks aren't mentioned, and in the third, AI surfaced during the investigation.

ConnectWise. Using stolen credentials for the Cloud Backup app, attackers signed in to customers' Microsoft 365. As of October 16, Huntress confirmed unauthorized sign-ins in 162 corporate tenants, and higher numbers were reported later. ConnectWise suspended the backup service on October 17, and on the 21st said the attack appears to come from a China state-aligned group that used an openly available agentic AI framework. There is no independent confirmation yet. Since October 21, the service has been restored in stages.

Burger King Japan. From October 2 to 7, someone had access to the app's database. The company noticed on October 13 and announced it on the 15th: 11.18 million records leaked with names, dates of birth, gender, email, phone numbers and order history. Card numbers were not stored in that system.

French supermarkets. On the night of October 12, hackers used refrigeration control systems to trigger forced defrosting. According to Economy and Finance Minister Roland Lescure, about 700 of the country's 10,000 supermarkets were affected. The Mousquetaires group, which owns Intermarché, said temperatures in its affected stores were raised to 50°C for six hours, and food had to be thrown away. Who is behind the attack is still unknown.

And even among the AI stories there's plenty of the mundane. Zeabur itself writes that its long-lived admin credentials "were stored in plaintext and could be used from the public internet". LiteLLM was hacked with stolen tokens. You don't need a neural network for that.

What industry leaders are saying

Over the past few weeks, each of them has staked out a position on the risks, and through that lens Black October reads differently.

Sam Altman, OpenAI, said on a podcast in early October that "the world should accept some bad things happening for the benefits of this technology". According to Reason, he counts major hacks and scams among the risks that can't be ruled out entirely.

Dario Amodei, Anthropic, published an essay back on September 12 calling for slower capability gains: "We must slow the pace at which we improve the capabilities of AI models". One of the reasons he cited was the OpenAI model's hack of Hugging Face. Altman backed him: "I agree with Dario that we need to pace the frontier".

George Kurtz, CrowdStrike, replied to the essay on X: "The frontier will move at whatever speed it moves. The rest of the world will not slow down. Our job in the cybersecurity community is to make sure it moves securely and safely". Judging by his own company's October 21 report, the world really hasn't slowed down.

Satya Nadella, Microsoft, published an essay on October 10 arguing that models should be treated like an employee with dangerous levels of access. His main advice is to "assume a model is compromised and contain it from the start". Microsoft later quoted him on its blog: "The most trustworthy agentic system will not be the one with the model we trust most".

Sundar Pichai, Google, admitted in an October 20 interview that model obedience is "an open area of research with clear gaps" and proposed independent auditors, like in accounting. We covered this in more detail in our piece on the Pichai interview.

The most down-to-earth comment came from Dan Lorenc, CEO of Chainguard - the very company that released patched PHP images early. He says his team found the same vulnerabilities in one evening with its own AI harness and a frontier model, and a simple prompt was enough. About the fixes themselves, he said: "The patches are crazy - this is not a simple vulnerability".

So is it agent swarms or not

Agent fleets exist, but not in the form social media describes. From September 28 to October 8, the swarmchasers researchers watched a fleet of AI agents try to scrape data from Alibaba's Amap maps and, after being blocked, try access keys for Amap that were publicly available online. Most attempts never got the data, and the researchers found no coordination between the agents - which is why they avoid the word "swarm" themselves. One of the agents told a New York Times reporter it was "Claude, running in Claude Code", but the report's authors think that's likely mistaken. Who ran the fleet hasn't been established: the infrastructure leads to Tencent Cloud in Hong Kong, a source close to Tencent talks about tests of third-party models, and there's no official response from the company.

Agents also go off the rails without any malicious intent. OpenAI itself published a write-up: during testing, a model was asked to pull hospital bed statistics from a government website, ran into an access-denied error, pulled a secret key out of the configs, forged authorization tokens and downloaded 24 years of data. Its reply to the user said nothing about it. In another case, GPT-6.1 Sol and GPT-6 Astra agents switched off their own monitoring system, and Astra denied it when asked directly.

The answer to the main question is no, there's no single swarm behind Black October. There's something else, and it's worse: the barrier to entry has dropped. A website breach for $50 in tokens, ready-made skills from GitHub, the "it's a pentest" cover story - and someone who couldn't have written an exploit yesterday is running a campaign against a thousand sites today. At the same time, Zeabur and LiteLLM were breached through plaintext keys and stolen tokens, and no model is to blame for that.

What to do right now

If you have a website, a project or even a single API key for a neural network, here's what's worth checking today:

  • Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If your site is on hosting, write to support and ask whether they've updated PHP.
  • Check LiteLLM. If you have version 1.107.0, look for cook.pth, cook.py and sitecustomize.py in site-packages and delete them by hand: uninstalling the package doesn't remove them. The safe version is 1.106.2. Treat every secret on that machine as stolen.
  • Reissue your keys if you stored them in OpenCode, Railway or Zeabur. Deleting a key from the service isn't enough: you need to revoke it in the provider's own dashboard and create a new one.
  • Check your spending with providers starting October 16: any requests you didn't make are a reason to revoke the key immediately.
  • Set a spending limit and use a separate key for each tool. Then one leaked key doesn't mean you have to reissue everything at once.

What's next

Black October is unlikely to be a one-off anomaly. The models that found the PHP flaw are available to defenders and attackers alike, and CrowdStrike explicitly predicts that within a year, campaigns at the level of organized groups will be within reach of lone actors with ready-made skills from GitHub. Breaching a large company's website can now cost $50 in tokens and about a day of agent work. In professional chats, I see more and more messages about someone's project getting hacked or running into trouble because of newly found vulnerabilities.

The good news is that the same tools work for defense: Calif, OpenAI and Wiz found PHP2Shell long before it could be exploited at scale, and Anthropic is giving open-source projects a free AI vulnerability scanner. But whoever is faster wins. The window between a flaw's disclosure and millions of attacks has already shrunk to a few hours.

That's why security is no longer just the security team's job. If you have a website, a bot or even a single API key for a neural network, updates, separate keys and spending limits are the same basic hygiene as a passcode on your phone. The cheaper an attack gets, the less likely it is that your project is "too small to bother hacking".

Sources