Black October: What PHP2Shell, eMudhra and AI-Powered Attacks Mean for the SOC

On Wednesday, October 21, Patchstack reported exploitation of PHP2Shell, two critical flaws in the PHP runtime. The fixes shipped about six hours later. Researchers had found both flaws with AI models. Within a day, people in infosec were calling it Black October. For a SOC, it was an investigation problem before it was a patching problem.

What happened

The name came from a widely shared X post on October 22 that called the previous 48 hours the worst in cybersecurity history. Axios and 404 Media picked it up the same day. These six incidents shaped the coverage.

Incident	What happened	Source & date
PHP2Shell (CVE-2026-109618, CVE-2026-109619)	Two CVSS 9.2 remote code execution flaws in the PHP runtime, found with GPT-5.6 Sol and Gemini 4 Argon. Finland, the Netherlands and France took government sites offline.	The Hacker News, Oct 21; Decrypt, Oct 21
eMudhra intermediate CA keys	Eight CA private keys were generated so weakly that anyone can compute them from the public certificates. Mozilla removed emSign ECC Root CA G3, and about 30,000 certificates need replacing.	The Hacker News, Oct 21; Help Net Security, Oct 21
Storm-0940 and ConnectWise	Microsoft tied a supply-chain compromise targeting more than 2,250 tenants to a group using ARTEX, an open-source agentic AI penetration testing framework.	Microsoft Security Blog, Oct 21
LiteLLM 1.107.0	A hijacked release pipeline shipped a credential stealer in the AI gateway. Stolen AWS credentials were tested about 4.5 hours after exfiltration.	The Hacker News, Oct 21
Railway	Attackers may have obtained decrypted customer secrets. Railway told all users to rotate keys.	TechCrunch, Oct 22
Cairn	Attackers ran the open-source AI agent platform against hundreds of payment and e-commerce sites.	SecurityWeek, Oct 20

Six security incidents behind Black October, October 20 to 22, 2026: what happened and where it was reported

Both sides now run on AI

Calif found the first PHP2Shell issue on August 1 using OpenAI’s GPT-5.6 Sol. Wiz found the flaws independently using Google’s Gemini 4 Argon and Sol. The code had sat in PHP for more than a decade. Sol also sits behind Daybreak Blue, the OpenAI tier that gives vetted defenders the model without its system-level cyber guardrails. In September, OpenAI said GPT-6 Astra was its first model to reach the Critical cybersecurity threshold. The company now expects findings like PHP2Shell “to increase sharply in the coming months.”

Our guide to triaging AI-discovered vulnerabilities said other models would follow Anthropic’s Mythos into vulnerability discovery. Wednesday’s biggest finding came from two of them.

Attackers moved at the same speed. Storm-0940 used ARTEX to automate scanning, password spraying and OAuth abuse at up to 2,900 sign-in attempts a minute. Some organizations saw privileged cloud access within three hours. Open-weight models help attackers too. In July, Palo Alto Networks’ Unit 42 found an operator running DeepSeek inside an open-source agent framework that, after one Telegram instruction, attempted exploits against more than 460 targets. Taiwanese firm TeamT5 calls DeepSeek “the AI of choice for Chinese hackers because it’s relatively powerful with very low cyber guardrails.” At LiteLLM and Railway, the target was AI infrastructure itself. Microsoft’s report put the shift in one line: “Agents are not constrained by factors affecting humans.”

The patch window went negative

PHP2Shell had a two-month coordinated disclosure plan. A leak cut the last day short. Times are UTC.

Oct 20, evening: The CVE IDs leak on Hacker News. PHP moves its release up a day.
Oct 21, 02:29: An archive with leaked vulnerability details reaches VirusTotal.
03:02: Cloudflare enables default WAF rules. Attackers start changing payloads.
07:34: Patchstack reports exploitation from hosting partners.
13:52: PHP ships the fixes.
14:19: watchTowr reports active exploitation of both CVEs.

For a SOC on the US West Coast, the first exploitation report landed at 12:34 a.m. The patch arrived at 6:52 a.m. A patch stops new exploitation. It tells you nothing about the servers reached before it. That is the negative patch window, and it turns every exposed host into an investigation problem.

Most of the breaches started months earlier

Forkast called Black October “a disclosure wave, not an attack wave.” SecurityToday’s dates back that up:

ETS (California student data): May 22 to September 18.
PingCAP: September 9 to October 7.
Palo Alto PAN-OS CVE-2026-0257: attacks from May 17, per Rapid7.
Paradigm Healthcare: access in October 2025, letters dated September 14, more than 970,000 people affected.
SafePay: active since August 2024, with at least 600 victims, per an October 20 joint advisory.

Patching PHP2Shell did nothing about intruders who arrived in May. Those breaches were an investigation problem months before anyone wrote a patch.

What Black October asked of a SOC

Four jobs, all due before the patch finished rolling out. Morpheus AI lets analysts work each one at the pace the attackers set.

1. Scope the exposure. Which hosts run PHP, on which branch, under which server API? Modat counted 79% of version-readable PHP services on branches that get no official fix. Morpheus Attack Path Discovery checks each finding against asset inventory, identity exposure, existing controls and reachability. Analysts get a chainability verdict and a remediation order through vulnerability triage.

2. Hunt backward. Look for multipart requests followed by memory-limit errors or repeated HTTP 500s, oversized PHPSESSID cookies and unexplained worker restarts. Morpheus Threat Hunting builds a hunt from a plain-language description, runs it across connected sources and returns the attack path or a recorded clean result. Check your retention against the dates above: PingCAP’s intrusion began six weeks before Black October, and ETS’s began five months before.

3. Act, with an analyst approving. The mitigations were production changes: WAF rules, request-size limits, session.upload_progress.enabled=0 and credential rotation. Morpheus generates a runtime playbook for each incident and holds every state-changing action behind an approval gate. The analyst decides; Morpheus executes and records each step. Response & Orchestration and Autonomy Modes set those gates.

4. Keep the queue moving. Morpheus triages up to 95% of alerts in under 2 minutes at L2+ depth. When Morpheus is uncertain, it defers to a human. Its 800+ integrations repair themselves when vendor APIs change, so the pipeline keeps running through an incident like this one.

On October 22, Jason Clinton posted this advice for security leaders:

as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)
— Jason D. Clinton 🔸 (@JasonDClinton) October 22, 2026

Defenders need the faster loop

OpenAI’s Greg Brockman said: “Defenders need to have a tighter OODA loop than attackers.” Our AI Vulnerability Flood whitepaper described the gap: “Discovery runs at machine speed. In most SOCs, triage still runs at human speed.” Morpheus gives your analysts machine-speed triage and keeps every action under their approval. The next disclosure wave will be an investigation problem before it is a patching problem. Work it in that order.

Next steps: