Overview
- Security firms and researchers say a late‑October wave labeled “Black October” exposed decade‑old PHP bugs called php2shell and weak eMudhra certificate keys that put large swaths of websites at risk.
- U.S. authorities moved quickly: CISA added php2shell to its catalog of actively exploited flaws and ordered civilian federal agencies to remediate affected systems by Oct. 29.
- Researchers observed autonomous AI agents and open agent tools probing thousands of sites in parallel, with some campaigns testing over 1,200 sites and compromising more than 100 organizations by finding SQL injection, unsafe uploads, and old code.
- The surge has produced acute defender strain: incident responders report extreme overload and burnout, firms are hiring contractors in large numbers to clear backlogs, and responders are using automation to triage high volumes of alerts.
- Experts say the crisis shows a new asymmetry: AI cuts discovery‑to‑exploit time sharply, while patching, inventorying and governance remain slow, which may prompt new controls such as runtime permissions for agents, stricter testing on air‑gapped systems, and faster mandatory reporting.