{"slug": "black-october-why-bugs-discovered-by-openai-tech-are-creating-a-cyber-emergency", "title": "Black October: why bugs discovered by OpenAI tech are creating a cyber emergency", "summary": "OpenAI's technology discovered two critical vulnerabilities in PHP, the server-side language used by roughly 70% of websites whose server-side language is known, and security patches were released on Oct. 21, 2026, prompting dozens of websites in the U.S., U.K. and elsewhere to briefly go offline. OpenAI said \"to our knowledge, frontier AI found these vulnerabilities before attackers did,\" while cybersecurity firm Wiz wrote that the findings \"rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.\" The flaws, dubbed \"php2shell,\" went undetected for more than a decade and could have let attackers take control of servers or steal passwords and data, putting the National Security Agency and Europe's cybersecurity agency on alert.", "body_md": "The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered.\nWhy it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data or take control of affected servers.\nIf exploited, the bugs could allow attackers to steal sensitive information, like your passwords and data, or take control of vulnerable servers.\nDriving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches.\nDozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. \nThe disruption put the National Security Agency and Europe's cybersecurity agency on alert.\nState of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately.\nWhat they're saying: OpenAI's technology helped find the bugs, and the company called the discovery \"one of the most impactful security issues in recent memory.\"\n\"To our knowledge, frontier AI found these vulnerabilities before attackers did,\" OpenAI said.\nThe cybersecurity firm Wiz wrote in a blog post: \"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.\"\nRead more below.\nWhat is PHP?\nYou've probably never heard of PHP, even though you've interacted with it for decades.\nPHP, which stands for Hypertext Preprocessor, is a programming language used by roughly 70% of websites whose server-side language is known.\nIt has been around since the 1990s to help build websites, taking data and generating content sent to a browser.\nIt's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. \nHow it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content.\nWhat was the PHP vulnerability, exactly?\nAI researchers discovered two critical vulnerabilities in PHP that could have allowed an attacker to take control of a website's server without having legitimate access to it.\nHackers could exploit the flaws, dubbed \"php2shell\" by cybersecurity firms, to steal information from those websites.\nBetween the lines: The flaws went undetected for more than a decade because exploiting them required complex technical work that AI helped researchers discover, per Wiz.\nWhy cybersecurity incidents are a big deal\nThought bubble via Axios' Bradley Olson: The PHP vulnerabilities are so serious that the NSA warned website operators to take their sites down if they didn't have enough time to patch the bug.\nBut the cybersecurity problems in recent days have extended far beyond that and include disruptions to developer platforms, data leaks on public schools, break-ins on public companies and more.\nA major Axios scoop also revealed that banks are detecting unauthorized third-party agent access inside customer accounts, a problem they are racing to contain.\nCyber pros are calling the series of attacks \"Black October\" due to the sheer volume and the level of risk, although so far many organizations have mitigated the risk and avoided massive real-world harm.\nWhile defenders and AI companies have warned for months that a season of cyber emergencies would imminently arrive, they have also been working to secure some of the obscure software that still underpins much of the modern internet ecosystem.\nThe bottom line: As attacks continue, experts have urged users to secure passwords, use a password manager and also to avoid panic.\nAs with any cyber emergency, the true barometer of harm is the extent to which damage seeps into the real world, as it has done with ransomware that took hospital software offline or a pipeline system that disrupted fuel supplies briefly on the East Coast.", "url": "https://wpnews.pro/news/black-october-why-bugs-discovered-by-openai-tech-are-creating-a-cyber-emergency", "canonical_source": "https://www.machinebrief.com/news/black-october-why-bugs-discovered-by-openai-tech-are-creatin-3qcv", "published_at": "2026-10-22 18:01:31+00:00", "updated_at": "2026-10-22 19:14:13.062312+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "ai-research"], "entities": ["OpenAI", "PHP", "Wiz", "National Security Agency", "Axios", "Wikipedia", "WordPress"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/black-october-why-bugs-discovered-by-openai-tech-are-creating-a-cyber-emergency", "markdown": "https://wpnews.pro/news/black-october-why-bugs-discovered-by-openai-tech-are-creating-a-cyber-emergency.md", "text": "https://wpnews.pro/news/black-october-why-bugs-discovered-by-openai-tech-are-creating-a-cyber-emergency.txt", "jsonld": "https://wpnews.pro/news/black-october-why-bugs-discovered-by-openai-tech-are-creating-a-cyber-emergency.jsonld"}}