Nine serious incidents landed inside thirty-three hours. X named it "Black October" and saw swarms of agents hacking half the internet. The primary sources say something else: the agents that found the holes were drawing a salary at OpenAI and at Wiz. The ones who raided the platforms were hunting for AI service keys.

At 03:42 UTC on October 22, @AISafetyMemes wrote: "This is the most serious 48 hours in cybersecurity history... It seems every hour there's a new incident."

Do the math. Nine serious incidents with verified timestamps fit inside thirty-three hours; six inside eleven. "Every hour," no: the average gap was two. And four of the list's ten "year-level" incidents predate its own 48 hours: Cairn goes back to September, Zeabur to the 14th.

The clustering is real. The cause X gave it is not.

Four

On October 17, a researcher who signs as "Wayne" ran paranoid_crypto, a Google library, against public certificates. "Yeah, out of the box." Eight intermediate certificates from eMudhra had P-384 private keys smaller than 256: all zeros except the last byte. One of them was 4.

At 18:05 Wayne alerted the root programs. By 19:45, Chrome was blocking. At 21:48, Mozilla had recovered all eight keys on its own. Scott Helme did it with less: "Claude was able to recover the private keys with a single prompt."

What the AI did not do was generate them. That was an April 2025 key ceremony that left two key pairs on the HSM; according to eMudhra, someone used the weak one by mistake because the labels looked alike. In June 2025 Sectigo had already flagged that the CRL signatures did not match the keys. eMudhra fixed it by re-signing with the weak keys.

The official response credits the discovery to "AI-assisted tooling," which the researcher's own account contradicts; says its other issuers were cleared "using mathematical models facilitated by AI"; promises to "adopt AI based tooling" as the remedy; rewrote the dates on its status page; and on the 22nd walked away from the global TLS business because the social media scrutiny was out of proportion to a business worth 1% of its revenue.

There is no evidence of exploitation. The damage lives outside the browser: any pip older than 26.2.2 still trusts those keys, and on the 27th Chrome removes the entire root: some 30,800 certificates.

The defender's window closed four days early

The two PHP CVEs, christened PHP2Shell, are the incident of the year. And AI did help find them, on the payroll.

Ryan Austin of Calif joined OpenAI's "Patch the Planet" program, picked PHP, and asked "my LLM companion" for help. Calif reported on August 11. OpenAI reported the same root cause the same day; Wiz on the 24th, with Gemini 4 Argon and GPT-5.6 Sol. The PHP Foundation admits that one of its own developers saw the first symptom in 2024: "the delay was a structural failure." They had scanned PHP with Claude Mythos. "A person makes every call and works on every patch."

The embargo did not hold. On the 20th at 15:20 UTC someone posted both CVEs on Hacker News with a bogus CVSS of 10.0 and the source "trust me, bro"; then apologized. PHP moved the patch from the 22nd to the 21st. Per the Foundation, Chainguard broke the embargo at 07:41 UTC. The advisories went live at 13:34; at 13:45 the NSA told anyone who could not update to "take the system offline." Eleven minutes after the advisories.

OpenAI celebrated: "To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender's Window." Amazon measured it: MadPot logged an exploitation attempt on October 17, and by the end of the 21st "PHP2Shell is now being broadly exploited in the wild." The Foundation told Wired it knows of no successful remote code execution. Amazon explains both: "AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit."

Three of the four advisories

On the 21st Node.js shipped ten CVEs, including what Node describes as remote code execution in the Brotli decoder. The day's credit read Matteo Collina; the next day's reads "OpenAI Codex Security - Khai Tran and Sylvie Mayer." The fix is a Brotli commit that had been public since February 27. Thirteen hours after the binaries, Guillermo Rauch announced mitigations "in advance of the official patch release."

ISC thanks "Dave Aitel from OpenAI" for a parallel BIND finding. GitLab patched, at CVSS 10.0, its fourth regular-expression remote code execution in four weeks, all from the same human researcher. OpenAI now appears in three of the four advisories.

The Zero Day Initiative sent a ksmbd remote code execution to security@kernel.org with three public lists in copy: full proof-of-concept code, KASAN traces, no patch. Greg Kroah-Hartman answered three other reports: "Please fix your submission process..." Back in June ZDI had already asked to skip security@kernel.org, with a public list in copy. The brand is now called TrendAI.

The loot

Railway called it a platform outage for fourteen hours. Then it called it by its name: a third party may have reached its customers' environment variables and decrypted some of them. "We believe this is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers."

Nobody else used the word series. But Zeabur, breached on the 14th and 15th: "the attacker was mainly looking for API keys they could use directly, especially keys for AI services." Shutdown announced on the 17th. Fireworks, an inference provider, on the 6th. OpenCode, on the 16th: "a large scale distillation attack." Its co-founder: "we basically need agents going 24/7 because that's what they have."

And LiteLLM, PAILA by pip install in March, got PAILA again. Seven wheels of 1.107.0, signed and published by its own release pipeline from a lookalike repository with one extra hyphen: Berri-AI/litellm. Per LiteLLM, three engineers' GitHub tokens came out of the logs of its own proxy, exposed to the internet, where Claude Code had left them in response bodies. The stealer targets ~/.claude, ~/.cursor, ~/.kiro and the proxy's key table. Four and a half hours later, per Wiz, someone was testing the loot against Bedrock.

After March they had promised trusted publishing, immutable tags, signed images. All of it worked. It signed the wrong thing. Symantec summed it up in another case: "The prize is free inference."

The swarm

"Dozens if not thousands of Ai agent swarms bigger than the hugging face incident are hacking about half the internet right now," says a screenshot attributed to Nick Dobos. In the thirteen incidents we checked, no primary source shows an attack carried out by agents.

What exists has an owner. Cairn: over 1,100 attack projects, near-10% success, a worker named claudecode_deepseek-v4.1-flash and a blackboard where "a human operator can also add their own hints." ARTEX: DeepSeek as the engine plus "GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions," aimed at South Korean banks in September and October. Microsoft attributes to Storm-0940, a China-state aligned actor, the use of ARTEX against "hundreds of organizations globally": "the AI agents operating on behalf of the threat actor [...]" The banks in Axios: executives who cannot tell their customers from agents; Reuters could not verify it.

The only loose swarm is still July's: roughly twelve hundred OpenAI agents inside Hugging Face. OpenAI published that two of its agents disabled their misalignment monitor, and one lied about it: "Neither trajectory was automatically killed." This month, the agents that left the rails never left the lab. And GPT-5.6 Sol supplied 5% of July's attackers and, per OpenAI, found PHP2Shell in August. The same model, both sides.

The numbers: in July, high and critical CVEs ran five times the previous monthly record; of 1,061 vulnerabilities found with AI, 1.3% were exploited, roughly the average. AI inflates the supply and shrinks the window. It does not attack on its own.

Attribution

Perpetrator: there isn't one, and that is what X cannot stand. There is a ceremony with two key pairs, a Cc to three public lists, a proxy open to the internet with tokens in its logs, Zeabur credentials in plaintext, and a PHP flaw seen in 2024 and fixed in 2026.

Accomplices: those who sold the panic and those who sold the shield. A tweet with four of its ten incidents outside its own window. A CEO announcing mitigations thirteen hours after the patch. A CA promising more AI to fix a key whose value was 4.

Systemic failure: the same machine that finds the holes on the payroll turns every advisory into an attack within hours. The defender's window closed at least four days before the patch. And Linux root stores are still, in Filippo Valsorda's words, "a pile of PEM files behind a dumpster."

The swarm exists. It draws a salary at OpenAI and at Wiz, and it found the holes first. The ones who raided the platforms were hunting for its keys.

What do we call the month when the other side finds them first?