What actually happened during Black October? I've worked in cybersecurity for more than two decades now, and I've lived through some...
 |
| What actually happened during Black October? |
Over the last 48 hours, social media has been flooded with reports of critical vulnerabilities, software supply-chain compromises, exposed credentials and AI-assisted cyberattacks. Some people are calling it "Black October," and one widely shared post claims there have been more than 27 major cybersecurity incidents in just 48 hours. But here's what worries me. Even when you remove any exaggerations from the reports, the underlying developments are extraordinary. I don't think this is simply another bad week for cybersecurity. I think we're getting a preview of what the next decade of cybersecurity could look like.
What Happened During Black October?
Let's look at some of the developments that emerged between 21 and 23 October. First, there was PHP. On 21 October, OpenAI published an announcement called "Patch the Planet: Global Response Coordination as Agents Uncover Critical Vulnerabilities." The announcement explained how frontier AI had helped security researchers discover critical vulnerabilities in PHP, one of the foundational technologies of the modern web. Security firm Calif identified a critical vulnerability using OpenAI's GPT-5.6 Sol model, while Wiz independently discovered and reported both vulnerabilities. The weaknesses included remote code execution and memory disclosure risks in affected PHP installations. What makes this particularly interesting is that some of the vulnerable code had existed for more than a decade.
Think about that for a moment. We have a programming language used across a substantial portion of the internet, examined by developers and security researchers for years, and frontier AI is now helping uncover serious weaknesses that had remained undiscovered. The researchers didn't simply ask a chatbot to find a vulnerability. Their work combined frontier models, specialised research tools, technical expertise and extensive validation. But the results demonstrate how AI can accelerate sophisticated vulnerability research.
For me, however, the most interesting part of OpenAI's announcement wasn't the vulnerability discovery itself. It was what happened afterwards. OpenAI explained that it spent approximately two months coordinating with PHP maintainers, security researchers, infrastructure providers and government agencies to prepare fixes and protections before the vulnerabilities were publicly disclosed. The response involved organisations such as Wiz and Cloudflare, with PHP maintainers leading the development and release of the fixes. OpenAI described this opportunity as the "Defender's Window," a period during which security researchers and software maintainers know about a vulnerability but can prepare protections before the details become widely available. In this particular case, OpenAI stated that, to its knowledge, frontier AI had helped discover the vulnerabilities before attackers did.
That's a positive outcome for defenders. But it also raises an uncomfortable question. What happens when attackers gain access to similarly capable AI systems? OpenAI itself acknowledged that the same technology that helps defenders discover vulnerabilities could also help attackers develop offensive tools and exploits more quickly. And perhaps the most worrying statement in the announcement was that OpenAI has already identified several other significant vulnerabilities and expects similar findings to increase sharply in the coming months. That is OpenAI's expectation rather than a proven forecast. Nevertheless, it suggests we may be approaching a period in which the discovery of serious software vulnerabilities becomes considerably more frequent.
Now consider what that means for the average organisation. Most security teams are already overwhelmed by vulnerability reports, remediation backlogs and competing business priorities. If AI significantly increases the pace at which credible vulnerabilities are discovered, the pressure on those teams could become much greater. We may be entering an era where discovering vulnerabilities becomes easier, but fixing them remains just as difficult. And this isn't the only development from October that should concern us.
On 21 October, LiteLLM, a widely used tool for integrating applications with large language models, confirmed that its software release pipeline had been compromised. A malicious version of the software was distributed through Docker and Python package channels, containing malware capable of stealing credentials and introducing remote-code-execution tools. The affected releases were subsequently withdrawn. Consider the implications. An organisation might have spent months securing its own AI application, only to introduce risk through a compromised dependency it trusted.
We also saw serious concerns involving digital trust infrastructure. Google disclosed that private keys associated with eight eMudhra certificate-authority certificates had been compromised, potentially enabling forged certificates against systems that continued to trust those authorities. And then there was another important story. Microsoft published research describing how a state-aligned threat actor had used an agentic AI penetration-testing framework called ARTEX to automate cyberattacks against hundreds of organisations. Microsoft reported that some attacks resulted in privileged cloud access in less than three hours. The activity included attacks involving compromised third-party application identities, automated reconnaissance and attempts to manipulate cloud permissions.
These are different incidents with different causes, and there is no established evidence they were part of one coordinated operation. But together they reveal something significant about where cybersecurity is heading. We're seeing AI accelerate both vulnerability research and offensive cyber operations, while software supply chains and digital identities remain critical points of failure. And as OpenAI's announcement demonstrates, even when defenders discover vulnerabilities first, coordinating the response across the software ecosystem is an enormous undertaking. That's a difficult combination for organisations already struggling with security backlogs.
AI is Changing the Cybersecurity
For much of cybersecurity's history, sophisticated cyberattacks required considerable expertise, resources and time. Finding obscure vulnerabilities, understanding complicated applications, analysing software dependencies and developing reliable exploitation techniques were specialist activities. There were practical limits to how much work attackers could perform, but AI is beginning to change those limits. Frontier models can assist with code analysis, vulnerability research, reconnaissance, scripting and the automation of repetitive technical tasks.
This doesn't mean an inexperienced attacker can suddenly compromise any system with a chatbot. Successful exploitation still depends on the target, permissions, defensive controls, operational knowledge and many other factors. However, AI can reduce the effort required for some of the work that previously demanded substantial human time.
The Microsoft ARTEX investigation provides an important example. Rather than simply asking an AI model to generate a malicious script, attackers were using an agentic framework to automate activities across multiple targets. The significance is not that every attempted attack succeeded. Most targeting did not. It's that certain offensive workflows could operate at machine speed.
Now imagine what happens as these capabilities become cheaper, more capable and easier to integrate into existing attack infrastructure. Attackers may be able to investigate more targets, test more weaknesses and adapt their techniques more quickly. This fundamentally changes the economics of cybersecurity. When the cost of investigating potential vulnerabilities falls, more potential vulnerabilities become worth investigating. For defenders, that's both an opportunity and a problem.
Cyberdefence Still Moves at Human Speed
Here's something I've observed repeatedly throughout my cybersecurity career. We are exceptionally good at identifying problems, but fixing them is another matter entirely. Every organisation has vulnerability scanners, SIEM platforms, cloud security dashboards, penetration-testing reports and compliance findings. They generate enormous amounts of information about what might be wrong with our environments. But how often does discovering a vulnerability actually result in it being fixed quickly? A critical vulnerability gets identified.
Someone creates a ticket. The application owner disputes its severity. The infrastructure team needs a maintenance window, while the development team wants additional testing. Before you know it, three weeks have passed. Sometimes the vulnerability gets fixed. Sometimes it ends up in an exception register with a remediation date six months away. If you've spent any time working in enterprise cybersecurity, this probably sounds familiar.
Now consider what happens if frontier AI substantially increases the pace at which vulnerabilities are discovered and investigated. Your vulnerability management programme could face more credible findings while your organisation's capacity to remediate them remains largely unchanged. That's a dangerous mismatch, and I think it exposes one of the biggest weaknesses in how many organisations approach cybersecurity.
The OpenAI announcement highlights this problem particularly well. Even after the vulnerabilities were discovered, an enormous amount of work was required to validate the findings, prepare fixes, coordinate infrastructure protections and help affected organisations respond. And that was a coordinated effort involving some of the most capable organisations in the technology industry.
Imagine how challenging that process becomes for a typical enterprise with dozens of business units, hundreds of applications and security teams already operating at capacity. A security team receiving 500 new findings doesn't necessarily need another dashboard showing 500 red alerts. It needs to know which findings represent genuine business exposure, who owns the affected systems, what can be mitigated immediately and which changes can be deployed safely.
This is why I believe the next generation of cybersecurity will place much greater emphasis on security engineering, automation and contextual risk management. Not because humans are becoming irrelevant, but because humans shouldn't be spending their time manually performing every repetitive step in a process that increasingly operates at machine speed.
The Software Supply Chain
The PHP and LiteLLM stories highlight another uncomfortable reality about modern technology environments. Most organisations don't control all the software they depend on. Your applications might use open-source libraries, AI frameworks, third-party APIs, developer tools, containers and cloud services. A weakness in one component can potentially affect thousands of downstream systems, including organisations that have invested heavily in securing their own applications.
In the PHP case, vulnerabilities existed in the underlying language runtime, not necessarily in application code written by individual developers. In the LiteLLM incident, the problem was a compromised distribution pipeline that delivered a malicious release. These are fundamentally different failure modes, but they expose a common weakness: organisations often lack complete visibility into the software and services supporting their business.
Imagine a CISO being informed that a critical vulnerability affects a library used across the organisation. Can the security team immediately identify every affected application? Does it know which applications are exposed to the internet? Can it trace the vulnerable component back to a business service and accountable owner? And if the issue involves a malicious software update rather than an ordinary vulnerability, can the organisation determine whether the affected version was installed, what credentials may have been exposed and whether attackers gained persistence? These aren't theoretical questions. They're exactly the kinds of problems security teams face during serious supply-chain incidents. If answering them requires days of investigation, the organisation is already operating at a disadvantage.
Software bills of materials, dependency monitoring, secure build pipelines, identity controls and cloud asset visibility are becoming increasingly important. But collecting information is only useful if you can act on it. A perfectly maintained inventory doesn't provide much protection if nobody knows how to connect an affected component to the business service it supports or the team responsible for fixing it. The organisations that handle these incidents effectively will be the ones that connect visibility with ownership, prioritisation and remediation.
CISOs Need to Prepare
There's another side to this conversation that isn't receiving enough attention. Much of the discussion around AI security focuses on securing AI applications. We talk about prompt injection, sensitive data exposure, model vulnerabilities and autonomous agents. These are important topics, and organisations deploying AI systems absolutely need to understand them. But frontier AI also changes the threat environment surrounding every other technology in the organisation. AI-assisted vulnerability discovery affects traditional applications. Agentic automation affects the potential speed and scale of attacks. Software supply-chain compromises can affect both AI and non-AI systems. And powerful AI agents introduce new questions about identity, access, permissions and accountability.
For CISOs, this means AI can no longer be treated as an isolated technology risk managed through a separate AI policy. It needs to become part of the organisation's broader cybersecurity strategy. If I were reviewing a cybersecurity programme today, I'd want to understand how quickly the organisation could identify its exposure when a critical vulnerability is disclosed in a widely used component. I'd also want to know whether our vulnerability management and remediation processes were capable of responding to AI-accelerated threats. Then there are the questions about identity and automation. Do we understand the permissions granted to third-party applications, AI agents and machine identities? Are we using AI to improve defensive operations, or are we still depending entirely on manual investigation and remediation? And perhaps most importantly, can we measure how effectively our security teams reduce actual exposure rather than simply counting the vulnerabilities they discover?
Why This Will Become the New Normal
I don't think we'll necessarily see 27 genuinely major cybersecurity incidents every 48 hours. That would be a dramatic prediction, and the evidence doesn't support making it. But I do believe the conditions that created this October's extraordinary concentration of security news will persist. Not every future week will look like Black October. But shorter response windows, AI-assisted vulnerability research, software supply-chain risks and automated attacks could become increasingly familiar features of the cybersecurity landscape. That is the change worth preparing for, rather than getting distracted by the exact number of incidents in a viral social media post.
If you're a cybersecurity professional reading this, I wouldn't recommend panicking or immediately signing up for every AI course you can find. I would recommend becoming more deliberate about the skills you develop. If you're technical, start experimenting with AI coding tools. Take a small, deliberately vulnerable application and use Claude Code to perform a security review.
Compare its findings with a conventional scanner, validate the results and work through the remediation process. Document what worked and what didn't. Pay particular attention to cases where the AI produced convincing but incorrect findings, missed a vulnerability or proposed a patch that needed substantial revision. That exercise will probably teach you more about practical AI-assisted security engineering than weeks of watching product demonstrations.
If you're in GRC or security leadership, spend time understanding the capabilities and limitations of frontier AI. Examine how AI changes your threat models, your security controls and your organisation's appetite for automation. And if you're a CISO, I'd recommend running a tabletop exercise based on the events of this week. Imagine a critical vulnerability is disclosed tomorrow in software used across hundreds of your applications.
At the same time, a trusted third-party integration is compromised and attackers begin using automated tools to investigate exposed systems. How quickly could your organisation identify its exposure, contain the threat and recover? Would your teams know which systems were affected and who was responsible for them? Could they deploy temporary mitigations while patches were being tested, and would you be able to give the board a credible update on the situation? The answers may reveal more about your actual cyber resilience than another quarterly security report.
Whatever your role, I think the most important thing is to stop treating AI as something happening somewhere else in the industry. It's already influencing the way vulnerabilities are discovered, attacks are conducted and security work can be performed. You don't need to become an AI researcher. But understanding how these capabilities affect your particular area of cybersecurity is becoming increasingly valuable.
