AgentFlareSocial Pulse · AI · 2026-10-22 03:42 UTC
@AISafetyMemes: Black October and the PHP vulnerability
This is the most serious 48 hours in cybersecurity history. "Black October" they're calling it It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest inci…
You're reading the full report — free for humans and search engines.
The same content ships as a structured JSON dataset (normalized facts, sources and
citation arrays, no HTML parsing) so AI agents can consume it directly — metered per fetch via the open
HTTP 402 payment protocol.
crawlerAutoPrice=true · verify at https://esa.aisa.one/api/v1/access/verify
This is the most serious 48 hours in cybersecurity history. "Black October" they're calling it It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year* SUMMARY OF THE LAST 48 HOURS: YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year): 1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline. 2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4. 3. California: data on every public school student since 2023 stolen, including disability status 4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers 5. Zeabur: 321,810 accounts breached. The company is shutting down. 6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer 7. GitLab: a 10-out-of-10 severity hole in every version since 2014 8. Cairn: criminals used an AI hacking tool to break into 100+ companies 9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline 10. Onamae: malware planted on up to 26,739 customer servers in Japan MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents): 11. Signal: a bug could leave your mic and camera on after you hang up 12. NGINX: 3 critical holes in software running ~1/3 of websites 13. HTTP/3: a single connection can crash 7 of the 10 web server types tested 14. Plex: hackers breaking into home media servers 15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations 16. Palo Alto: ransomware gangs breaking in through company firewalls 17. Bullhorn: platform used by 10,000+ companies knocked offline 18. Medi-Cal: 970,000 patients' data stolen 19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites 20. AOMEI: backup software's update server handed out a backdoor 21. Meta Muse: Meta's AI agent exposed users' personal and business secrets 22. Tor: 333 relays hijacked to steal logins 23. TiDB Cloud: database company's cloud breached Also serious: 24. State Bank of India: India's biggest bank confirms a data breach 25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool 26. Siemens: a software hole being used to spread malware 27. North Korea: state hackers launch a new attack campaign on South Korea
Part of the conversation: Black October and the PHP vulnerability
@AISafetyMemes calls the last 48 hours the most serious in cybersecurity history, nicknamed Black October, and lists incidents such as PHP2Shell, which it says is a hole in software behind ~70% of websites, and Zeabur, with 321,810 accounts breached. @OpenAI says its models helped researchers find critical flaws in PHP, used to run an estimated 70% of websites, and that sites can now upgrade. Likes: 35.3K and 14.4K.
Why it mattersTwo high-engagement posts link AI to both the scale of recent incidents and a claimed defender-side discovery.
Other posts in this conversation
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors. Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact. This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare. https://t.co/TW3jrSbB3f
How it compares
This post ranks #4 of the 14 highest-engagement ai posts AgentFlare tracked on 2026-10-25, with 3.5× the median likes. See the full AI briefing.
How this page is made. Post text and engagement come from the AISA Twitter API (advanced search, top results). Conversation summaries are written from the post texts only; a post is the author’s claim, not a verified fact.
Sources & citations
- @AISafetyMemes on X 2026-10-22 03:42 UTC
- AISA Twitter API