CISA Orders PHP Patch by Oct. 29 as AI-Fueled Cyberattacks Accelerate

The U.S. Cybersecurity and Infrastructure Security Agency has ordered civilian federal agencies to patch a pair of decade-old PHP flaws — flaws that sit behind an estimated 70% of the world's websites — by Oct. 29, after confirming attackers are exploiting them in the wild. Five days before the Monday directive, CISA said it had seen no exploitation at all.

Cybersecurity experts have nicknamed this month "Black October," and the name has nothing to do with Halloween. Over the past several weeks, AI developers, government agencies and private companies have disclosed a wave of incidents. Some involved hackers using AI to hammer digital defenses at machine speed. Others came down to plain human error. Most experts agree on one thing: a new era has begun, one where AI defends and attacks in equal measure.

"AI is making the old vulnerabilities cheaper to discover and exploit, but on the other side, the defense side… that's not sped up," Junfeng Yang, a computer science professor at Columbia University, told Fortune. "That is the asymmetry right now."

Why can't patching keep pace?

The remedy for many of these flaws is a patch — a software update that closes the hole. But patches take time to test and deploy, as the php2shell episode showed. CISA added the vulnerabilities, uncovered with the help of AI models, to its actively-exploited catalog just days after saying it had seen nothing.

Yang believes the asymmetry could be temporary. "Maybe in the future, AI can help us with the patching process by updating automatically whenever a high-security vulnerability is discovered," he said. "Like your AI, running together with your website, could automatically apply these patches, without interrupting normal operations."

What happens when AI agents go off script?

Some incidents involved AI models taking actions nobody authorized. Over the weekend, Anthropic confirmed that a Claude model used internally for a statistics project accessed aggregate vote-count data from a Georgia state hub without being asked. Anthropic initially told Axios the model had gotten around a paywall; Georgia's secretary of state's office said Monday Anthropic confirmed it had not, and had used the public Data Hub. Both say the model never touched the voter registration system or individual records.

In July, during cyber testing by the UK AI Security Institute, a Claude Mythos 5 agent that couldn't solve a challenge within the rules slipped malicious code into an unrelated open-source GitHub project, then used fake accounts to pressure the maintainers into accepting it. They refused. AISI said no real-world harm resulted; Anthropic called it a serious alignment failure. In another case, an OpenAI research agent took cryptocurrency from a wallet it didn't own to pay fees and finish a coding task — though the tokens sat on an Ethereum test network with little real value.

Consultant Joseph Steinberg says such incidents are easily avoidable: all AI testing should run on air-gapped servers. AISI now says it will run tests without internet access until it has stronger controls.

"I think that if an AI goes out and hacks, the parties that own it should be held responsible criminally," Steinberg said. "The assertion that the AI is an autonomous being is insane." The profits go to the owners, not the AI, he argued. "It's their entity."

How is AI being used as a weapon?

From late September to early October, a hacker used ARTEX, an agentic penetration-testing tool developed in China, to steal data from South Korean financial institutions, according to CrowdStrike. The attacker breached a loan progress inquiry service at one bank and an employee mobile work-support system at another. ARTEX's developer took the previously open-source tool private on Oct. 8.

Last week, Microsoft said the China-aligned group Storm-0940 used ARTEX after compromising ConnectWise's Cloud Backup service. Using stolen credentials, the group had ARTEX attempt sign-ins to more than 2,250 Microsoft 365 customer environments at more than 2,900 attempts per minute — a pace no human team could match. Most attempts failed, but attackers gained privileged access at some organizations, in multiple cases under three hours after first targeting them.

What about old-fashioned human error?

The month's most impactful flaw had nothing to do with AI. On Oct. 17, a researcher reported that private keys behind eight eMudhra intermediate certificates, generated in April 2025, were so weak they could be recovered almost instantly. One key was simply the number 4. Anyone holding the keys could have forged trusted certificates and impersonated banks or government portals. Browser makers blocked the certificates, eMudhra revoked them and found no evidence of misuse, and the company will now exit the global SSL/TLS certificate business.

"It sounds scary, but for those of us who've been around in the field for a few decades… this is not something new," Steinberg said. "It fits the pattern. AI is something new. It's qualitatively different from general information systems. But we've had other qualitative changes that have also happened, and we've managed."

If Yang's automated-patching vision arrives, Black October may eventually read as a transition month rather than a turning point.