A massive digital shitstorm is tearing through the internet. Dubbed “Black October” or “Bloody October” by rattled experts, a series of catastrophic, AI-discovered software flaws has put the global tech ecosystem on immediate alert.
While 95% of the public went about their daily routines—drinking coffee, making calls, and checking apps—governments and tech giants scrambled overnight.
Frontier AI models developed by OpenAI and Google bypassed traditional human limitations to unearth "PHP2Shell," a chain of critical remote-code-execution vulnerabilities affecting PHP—a programming language powering nearly 70% of the internet, including WordPress and Wikipedia.
Concurrently, Node.js issued emergency patches for four high-severity flaws, while India’s CERT-In sounded alarms over cryptographic key vulnerabilities at digital identity firm eMudhra.
The U.S. National Security Agency (NSA) issued an extraordinary directive ordering organizations to update or immediately take vulnerable systems offline. Government portals in France, Finland, and the Netherlands briefly went dark as a precaution.
OpenAI acknowledged the double-edged sword, noting that while AI caught these decades-old human coding errors first, "the same capabilities can also help attackers rapidly develop offensive tools." Security firms like Cloudflare reported exploit attempts instantly surging into the millions. For an oblivious public, the reckoning is only beginning.