Black Cyber October: AI Has Eliminated the Hacker Shortage. How Is the Market Responding?
In October, two independent groups of cybersecurity experts discovered a critical vulnerability in PHP, the programming language used by approximately 70% of the world’s websites. Photo: Ben Griffiths / Unsplash.com
While experts were speculating about when Q-Day —the mass cracking of encryption by quantum computers—would arrive, it has, in fact, already arrived. Advanced AI systems have proven to be exceptionally good not only at writing and generating memes, but also at finding and exploiting cybersecurity vulnerabilities. The “armor versus shell” race in cybersecurity has accelerated—now, defense teams have only a matter of hours, not days, to respond.
"The Most Serious Vulnerabilities in the History of Software"
Cybersecurity experts are already calling October 2026 “Black October.” Two independent research groups have discovered a critical vulnerability in PHP—the programming language used by WordPress, Joomla, Drupal, Wikipedia, and approximately 70% of all websites worldwide.
A vulnerability in PHP code, dubbed PHP2Shall, had existed since 2012 but was considered practically impossible to exploit in the real world. The sequence of steps required to exploit it was so complex that it was at the very limit of what human researchers could achieve. But advanced AI models turned this long-standing flaw into a working exploit in a matter of days.
Two groups discovered the PHP2Shell vulnerability independently of one another. Ryan Austin of Calif identified the issue in August while auditing the PHP source code using OpenAI’s GPT-5.6 Sol. The same flaws were found by a team at Wiz, an Alphabet subsidiary—its researchers used their own autonomous system, Wiz Atlas, as well as Google’s Gemini 4 Argon and GPT-5.6 Sol.
Following the public disclosure of the vulnerability on October 21, Cloudflare recorded “millions” of hacking attempts, and several countries temporarily took their government websites offline to install security updates (patches).
Worse still, according to Amazon, the first attempts to use PHP2Shall from an anonymous IP address were detected as early as October 17, before the vulnerability was officially disclosed.
"It remains unclear how the attacker obtained information about the exploit before it was disclosed," Amazon stated.
The Wiz team classified PHP2Shall as one of the “most serious vulnerabilities ever discovered in PHP—and perhaps in the history of software.”
A tsunami is on its way
"No matter how bad things have been over the past four days, they'll get much worse before they get better," wrote Jason Clinton, deputy director of information security at Anthropic, on X.
He warns of an impending “tsunami of vulnerabilities” and urges executives responsible for IT security to seek help from their boards of directors: “Not for AI—for the basics. We need to hold out for about 18 months,” Clinton clarifies.
AI analyst Andrew Carran adds: “As for potential attacks on energy, food, and water infrastructure—the threat is very real. Someone is probing the infrastructure right now and testing its resilience. This is an active threat.”
He also highlighted the hack of Quest Diagnostics—one of the largest medical laboratories in the U.S., serving roughly half of the country’s hospitals and doctors. According to TechCrunch, the system is used by about half a million doctors and stores millions of medical records and files.
Salesforce CEO Marc Benioff agreed with Clinton’s assessment from Anthropic: “Jason is 100% right. Code Red,” he wrote on X.
"Red alert" is the term used in corporate America to describe a situation that requires immediate action at the highest level.
AI Became a Hacker
For years, the cybersecurity community has described AI as a “force multiplier”—a tool that makes existing attacks faster and cheaper—but Check Point Research’s annual report documents a shift that goes even further: AI has crossed the line between being an assistant and an operator. Previously, it helped hackers prepare attacks; now it writes and uses exploits on its own.
The most striking example from the report is the hacking of nine Mexican government agencies between late 2025 and early 2026.
A hacker ran Claude Code and GPT-4.1 in parallel: one AI processed the exploits, while the other analyzed the stolen data and automatically set tasks for the next steps. As a result, the two AIs carried out the operation on their own, stealing approximately 400 million records.
AI is now directly involved in every stage of the attack chain—from writing malicious code to executing commands within networks—with minimal human involvement between steps.
It’s not as if this came as a complete surprise. On August 27, 2026, OpenAI, Anthropic, Amazon Web Services, Microsoft, Google, and more than 100 other companies published a joint open letter. The gist of it: cyberattacks using AI against hospitals, water systems, and power grids are no longer a “remote risk.”
The coalition had warned that security teams had a “limited window—likely measured in months”—before AI-powered hacking tools would overwhelm them with attacks. As they say, they were spot on.
"We were protected by the lack of hackers"
One of the key challenges is speed. In 2026, 29% of the vulnerabilities published on the CVE portal were exploited within 24 hours of disclosure, while the average time for deploying a security patch in the cybersecurity industry is 55 days. This is a catastrophic gap, according to analysts at Palo Alto Networks.
Check Point believes that while cybersecurity teams used to have days to fix vulnerabilities, they now have only a matter of hours.
Amazon advises companies to actively seek out and fix vulnerabilities on their own, rather than waiting for them to be disclosed.
In addition, thanks to the industry's efforts, powerful AI models have become affordable and widely available, explains venture capitalist Matt Schumer in his blog, *Something Big Is Happening*.
Every building has its weak spots: a window that doesn’t latch, a back door with a cheap lock. It’s the same with software. It’s full of hidden vulnerabilities. For decades, detecting them required rare, highly skilled specialists, and there were few of them. That was our defense. Not good locks. Just a shortage of burglars.
But now the shortage of hackers is over.
Shumer advises individuals to install the latest updates on all their devices, delete unnecessary apps, visit only familiar websites, and enter banking information only on their bank’s website or in its official app.
“If you want to be extra cautious, keep a small amount of cash at home—enough to buy groceries for a few days, as well as some food and water. This is a standard emergency kit, and it’s worth having in any case,” he writes.
That sounds alarming, to say the least.
There's some good news, too
On the other hand, Bloomberg Opinion columnist Dave Lee called the PHP2Shell case ““the most significant victory for the good guys in the era of AI cybersecurity,” referring to the fact that security researchers as part of the Patch the Planet initiative managed to discover the vulnerability before hackers did and, through coordinated efforts, warned the world about the threat.
“Like a foiled terrorist attack or the Y2K problem, the general sense that ‘it’s no big deal’ can mask the behind-the-scenes heroism that—so far—has prevented a catastrophe,” he wrote.
The market took notice: After news of PHP2Shell became public, Cloudflare’s stock rose by more than 11% over three days, and by 87% since the February shock (when investors feared that Anthropic would undermine the cybersecurity industry). CrowdStrike rose by more than 160% over the same period.
It is hard to say how long this optimism will last. Several unnamed insiders in the AI industry told Axios that, in their opinion, a major cyber incident involving AI will occur within the next 6 to 12 months.
In short, the question isn't whether AI will become the primary cyberweapon of 2027—that has already happened. The question is whether defenses will be able to stay one step ahead of the attacks before something truly important is compromised.
This article was AI-translated and verified by a human editor
