Black October: why bugs discovered by OpenAI tech are creating a cyber emergency

Dozens of websites across the U.S., U.K., and globally were briefly taken offline following the emergence of a potential attack exploiting flaws in PHP.

This incident prompted governments and corporations to temporarily halt services while security patches were installed, putting the National Security Agency and Europe's cybersecurity agency on high alert.

The code in question, PHP, powers millions of websites, and the discovered vulnerabilities could permit malicious actors to steal sensitive data, such as passwords, or seize control of the affected servers.

OpenAI's technology was instrumental in finding these bugs, with the company calling the discovery "one of the most impactful security issues in recent memory." OpenAI asserted, "To our knowledge, frontier AI found these vulnerabilities before attackers did."

Cybersecurity firm Wiz noted in a blog post, "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history."

The critical flaws, dubbed "php2shell," were two vulnerabilities that AI researchers uncovered, allowing an attacker to take control of a website's server without proper credentials.

These flaws remained hidden for over a decade because exploiting them demanded intricate technical skill, which AI aided researchers in finding, according to Wiz.

Cyber professionals are labeling this period "Black October" due to the high volume and risk level of the attacks, even though many entities have managed to contain the threat so far.