People online are calling this month Black October. One viral post said the last 48 hours were the worst in cybersecurity history.
- PHP2Shell: Hackers fired millions of attacks at the PHP bugs AI helped find, and Japan’s ANA turned off Apple Wallet boarding passes.
- OpenCode: The AI coding tool got hacked, and one user found $400 in charges on their Anthropic account.
- One hacker, 100+ companies: AI agents did the breaking in for about $5,000, and Reuters found Deere and SharkNinja among the victims.
- LiteLLM: Someone slipped malware into this popular tool for switching between AI models to steal passwords and AI keys.
- eMudhra: An Indian company that vouches for websites had its secret keys compromised, which could let attackers pose as real sites. One key was literally the number 4.
- China-linked hackers: Microsoft says they’ve used an AI hacking tool against hundreds of organizations since September, sometimes getting admin access to a company’s cloud in under 3 hours.
Some of these holes sat there for over a decade before coming out this month. Nobody has confirmed a break-in through the PHP bugs yet.
And there are still eight days left in October.
