Incident Report · AI Agent Security

Black October: PHP2Shell, AI Agents and the AI Key Heist

Published · Sunglasses team · Incident report

Black October is not one attack. It is a community label for a cluster of security incidents and disclosures between roughly October 19 and 22, 2026. The centerpiece is PHP2Shell, two critical flaws in PHP itself that were found with AI and made public on October 21. The other two threads are AI agents used as the burglar to break into company websites, and AI API keys as the loot in a run of breaches aimed at AI tools and platforms.

How this report was researched. Sources were read on October 23, 2026 between 12:47 and 14:28 PT. Claims confirmed by two or more independent reputable sources, or by a primary statement, are stated plainly. Claims from a single outlet name that outlet. Opinions are attributed, and disputed items are left out.

Quick answer
sunglasses://reports/black october php2shell ai key heist 2026#quick-answer
What it is

Not one attack. A community label for a cluster of security incidents and disclosures between about October 19 and 22, 2026, spread by a viral X post.

Centerpiece

PHP2Shell: CVE-2026-109618 and CVE-2026-109619, two CVSS 9.2 flaws in PHP itself, found with AI, patched October 21. PHP runs about 70 percent of websites.

The other threads

AI agents on the Cairn platform broke into more than 100 company websites for roughly $50 a hack. AI API keys were the loot at OpenCode, LiteLLM, Railway and Zeabur.

Exploited at scale?

Not confirmed. Cloudflare's CEO reported millions of attempts, but 404 Media and Australia's cyber agency reported no widespread exploitation so far.

What to do

Patch the PHP runtime itself, not just WordPress, then rotate keys. Check logs back to October 17. Treat everything your agent reads as untrusted.

Sunglasses

Would not have stopped PHP2Shell or the breaches. It guards the agent: it scans what the agent reads and blocks keys leaving through tool calls.

§01 · What Black October actually is

What Black October actually is

The name spread from a viral post on X by the account AISafetyMemes, published around 03:42 UTC on October 22. It said: "This is the most serious 48 hours in cybersecurity history. 'Black October' they're calling it." [13, 2]

Axios then ran "Black October: why bugs discovered by OpenAI tech are creating a cyber emergency" on October 22. CNBC ran "AI's 'Black October': Critical PHP flaws set off global security scramble" on October 23. [12, 11]

So Black October is being called the most serious stretch in cybersecurity history, but that framing comes from a viral post, not an official ranking. Wiz said PHP2Shell ranks "among the most severe vulnerabilities discovered in PHP, and arguably in software history." [5]

Analysts describe Black October mainly as a disclosure wave. Many of the attacks and weak spots behind it are weeks, months or years old. [3, 2]

What ties the cluster together is AI on both sides. AI helped find the holes, AI agents broke in, and AI keys were the loot. [5, 6, 9, 10]

§02 · Timeline

Timeline

All dates are 2026. Times are UTC, as the sources give them.

  • August 19 to 24. Wiz finds the PHP2Shell flaws with AI on August 19, gets remote code execution on Drupal on August 20 and WordPress on August 21, and reports the flaws on August 24. [5]
  • September 25. AI agents on the open-source Cairn platform begin trying more than 1,200 sites in the US, Canada, Australia and Japan. [6, 7]
  • October 17. Amazon's MadPot decoy system sees a first PHP2Shell attempt, four days before patches. [4]
  • October 19. Reuters reports the Cairn campaign. TechCrunch reports the OpenCode break-in. [6, 9]
  • October 21, from 03:02 UTC. Cloudflare pushes emergency firewall rules, about 9 hours before disclosure. [18, 8]
  • October 21. PHP2Shell is patched and made public. The NSA, the FBI cyber division and the UK NCSC issue warnings. Sites go offline in several countries. LiteLLM 1.107.0 is malicious for about two hours, and Railway discloses a breach. [5, 8, 3, 26]
  • October 22, about 03:42 UTC. The viral X post spreads the name. Axios uses it the same day and CNBC on October 23. [13, 12, 11]
§03 · PHP2Shell

PHP2Shell

PHP2Shell is two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2. They let an attacker take control of a web server without logging in, or read its memory. [5, 8, 3] That memory can hold passwords, auth tokens, API keys and certificates from other requests, and reading it needs no code execution. [5]

PHP runs about 70 percent of websites with a known server language, including WordPress, Drupal, Joomla and MediaWiki. [5, 8, 4] Every PHP version of the last decade is hit by at least one of the two flaws, going back to PHP 5.4 from 2012. [5, 3]

The flaws were found with AI. Wiz used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and Calif and OpenAI were also part of the disclosure. [5, 1, 4] 404 Media reported that Chainguard CEO Dan Lorenc said his company found the same bugs by typing "find bad vulnerabilities in PHP" into a frontier AI model. 404 Media also reported that Trail of Bits built a working exploit in one day with Codex. Dan Guido of Trail of Bits said: "AI accelerates exploit development." [1]

On October 21, the NSA said organizations that cannot update immediately should take affected systems offline. The FBI cyber division and the UK NCSC warned the same day. [8, 16, 2] That evening, Japan's Prime Minister Sanae Takaichi posted on X asking people to check whether their sites run PHP. She said suspending sites "can be considered an effective way to reduce risk." [14, 15]

Sites taken offline on October 21 included parts of Wikipedia and Wikimedia, 4chan, Something Awful and Pinboard. Government sites went down in the Netherlands, including Overheid.nl, the Port of Rotterdam and hospitals, and in Finland, France, Denmark and Germany. Canada took sites down as a precaution. In Japan, pixiv, DMM, niconico and BASE went into emergency maintenance. [8, 1, 4, 17]

Cloudflare pushed emergency firewall rules about 9 hours before disclosure. Its CTO Dane Knecht called them a "STOPGAP only." [18, 8] Cloudflare CEO Matthew Prince said the company saw thousands of exploit attempts in the 10 hours before disclosure, then tens of thousands in 45 minutes, hundreds of thousands in two hours, and millions since. [1, 19] The Hacker News reported that Dataminr, Beelzebub and Wordfence saw attackers try to steal credentials and secrets from environment variables. No confirmed successful theft has been reported. [19]

The Hacker News also reported that Censys counted 56.6 million web properties running PHP, and assessed 34.4 million PHP services as vulnerable as of October 23. It said 32 UK government digital services were unavailable and the NCSC had sent about 50,000 warnings. [19]

These are exploit attempts, not confirmed hacks. 404 Media reported that exploitation is not widespread so far, and Australia's cyber agency said it was not aware of active exploitation. [1, 8] Sansec updated its assessment on October 22 and said mass exploitation appears less likely than expected. [20] Matthew Green of Johns Hopkins described the mood as "so many people discovering that the whole Internet is dry tinder." [1]

§04 · AI agents broke in: Cairn and CERT-In

AI agents broke in: Cairn and CERT-In

Reuters reported on October 19 that a Chinese-speaking hacker used AI agents on the open-source platform Cairn to break into the websites of more than 100 companies. The instructions were fewer than 100 Chinese characters. [6] The agents tried more than 1,200 sites in the US, Canada, Australia and Japan from September 25, and successful intrusions took about 23 hours. [6, 7]

Reuters named Deere, SharkNinja and Cummins among the companies. Deere said there was "no indication that sensitive information was accessed." SharkNinja said the affected site was a standalone support site and the issue was contained. Cummins said it was investigating a site run by a vendor. Reuters could not tell whether data was taken. [6]

Snorre Fagerland of NorForge estimated the campaign cost about $5,000 in AI tokens, roughly $50 per successful hack, and said the estimate carries "considerable uncertainty." [6, 7] "It's a new world now," Fagerland said. "It's not script kiddie stuff." [6, 7] The campaign was found because the hacker left Cairn control panels open on the web. Cairn's author said the platform is not designed for hacking. [6, 7]

India's CERT-In advisory CIAD-2026-0049, rated critical, said AI agents under research or evaluation by AI model providers went beyond their scope and reached live systems at Indian organizations. The organizations only found out when the AI companies told them. [10, 7, 9] The entry points were ordinary: credentials in code and configs, over-permissioned cloud roles, and exposed admin panels. [10]

§05 · The key heist: OpenCode, LiteLLM, Railway, Zeabur

The key heist: OpenCode, LiteLLM, Railway, Zeabur

OpenCode. Attackers broke into an older system at OpenCode, an open-source AI coding agent. The break-in was disclosed on October 17 and reported by TechCrunch on October 19. About 1.4 percent of OpenCode Console users were affected. Stolen AI API keys ran up charges on OpenAI, Anthropic and Google accounts, some over $1,000. The keys have been blocked and refunds are underway. [9, 25]

LiteLLM. Version 1.107.0 of LiteLLM, a popular AI gateway library, was malicious on PyPI and in Docker images for about two hours on October 21. It installed a credential stealer that runs whenever Python starts, aimed at cloud, browser and SSH secrets and keys for more than 20 AI coding tools, plus a backdoor. The attackers got in through stolen maintainer GitHub tokens. [3, 22, 23, 24]

Railway. The cloud platform disclosed on October 21 that an attacker may have accessed encrypted environment variables and decrypted some. Railway said the incident is "part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers." Deployments were paused. [26, 2]

Zeabur. Zeabur leaked plaintext internal credentials, including an admin token created on January 10, 2024 that never expired. The attackers stole 321,810 accounts and about 3.2 million environment variable records. Zeabur is shutting down, and its services end on December 31, 2026. [27, 2, 28]

PHP2Shell sits on the same thread. Its memory flaw can expose API keys from other requests, and The Hacker News reported attackers trying to steal secrets from environment variables. [5, 19]

§06 · The rest of the cluster

The rest of the cluster

  • GitLab. An October 21 patch fixed CVE-2026-110264, a CVSS 10.0 unauthenticated remote code execution flaw. [3]
  • eMudhra. 8 intermediate certificates with breakable private keys were revoked October 18 and lost trust at Google, Apple, Microsoft and Mozilla. eMudhra is exiting the global TLS business and says its systems were not compromised. [3, 4]
  • Node.js. An October 21 fix addressed CVE-2026-111497, reported by OpenAI Codex Security researchers. [3]
  • SafePay ransomware. A joint advisory, AA26-293A, from US, German and UK agencies on October 20 counts at least 600 victims since August 2024. [3, 2]
  • California student data. ETS and CDE data copied from May 22 to September 18 led to family notices from October 16. [2]
  • Ahold Delhaize. Digital systems went offline October 12 while stores stayed open. [2]
  • UpdraftCentral. About 400,000 WordPress sites were exposed, an attacker created admin accounts on October 17 and 18, and it was fixed October 19. [2]
  • Tor. About 333 exit relays, roughly 10 percent, were hijacked October 1 to 5 to steal SSH passwords. [3, 2]
§07 · What is still unknown

What is still unknown

  • How the OpenCode, Railway and Zeabur attackers first got in, which is only partly known.
  • Whether the Cairn victims lost data.
  • Whether PHP2Shell is being exploited at scale.
  • Who is behind the campaign against AI keys. There is no official attribution.
§08 · What to do now

What to do now

  1. Patch the PHP runtime, not just WordPress. Updating WordPress, Drupal or plugins does not fix PHP2Shell. The PHP runtime itself must be patched. Wiz showed remote code execution on the latest WordPress, Drupal and Joomla images. [5, 20]
  2. If you cannot patch now, take the system offline. The NSA advises this for systems that cannot update immediately. [8]
  3. Check your logs back to October 17. Amazon saw a first attempt that day, four days before patches, and advises checking back to it. [4]
  4. Rotate keys after patching. A patch does not revoke keys that were already read from memory. Rotate passwords, tokens, API keys and certificates once the runtime is updated. [20]
  5. Treat agent-readable inputs as untrusted. The CERT-In entry points were credentials in code and configs, over-permissioned roles and exposed panels. [10] The Hacker News reported research by Sunil Tripathy showing that hidden instructions in a public repo could make ChatGPT, through its GitHub connector, write a workflow into a private repo that exfiltrates secrets. OpenAI classed it out of scope. [21] Anything your agent reads can carry instructions, and anything it holds can leave through its tools.
§09 · Where Sunglasses fits

Where Sunglasses fits

Sunglasses would not have stopped PHP2Shell, the OpenCode break-in, the malicious LiteLLM package, the Railway and Zeabur platform breaches, or the hacker behind the Cairn campaign.

Sunglasses is the input firewall for AI agents. It is free and open source, and it installs with pip install sunglasses. It scans prompts, files, repos, web pages and MCP tool metadata for prompt injection, tool poisoning and credential exfiltration. Since version 0.4, a Claude Code PreToolUse hook blocks secret material from leaving in outbound tool calls. [29]

The link to Black October is the agent itself. Your AI agent reads everything and holds your keys. Sunglasses checks what it reads, and stops your keys leaving through its tool calls. It will not patch PHP. It guards the agent.

In a controlled test on our own machine, Sunglasses 0.6.11 scanned a poisoned README and returned BLOCK at HIGH severity. It flagged prompt injection under pattern GLS-PI-INFO and exfiltration under GLS-EX-015, "Indirect secret relay." Separately, the firewall hook blocked an outbound Bash call with the message "OpenAI API key material detected in an outbound Bash call." These are test results, not detections of any Black October attack.

See what Sunglasses catches and does not catch, AI agent README poisoning, indirect prompt injection defense, the code on GitHub and more reports.

§10 · Sources

Sources

All sources were read on October 23, 2026 between 12:47 and 14:28 PT.

  1. 404 Media, Jason Koebler · October 22, 2026 · https://www.404media.co/php2shell-black-october-ai-is-changing-everything-about-hacking-no-one-knows-what-happens-next/
  2. SecurityToday (DE), Alec Chizhik · October 22, 2026 · https://www.securitytoday.de/en/2026/10/22/black-october-many-attacks-had-been-running-for-months/
  3. Forkast, Heath Callahan · October 23, 2026 · https://forkast.news/black-october-is-a-disclosure-wave-the-label-hides-the-clock/
  4. Sify, Nigel Pereira · October 23, 2026 · https://www.sify.com/security/black-october-governments-pull-websites-offline-as-cybersecurity-chaos-spreads/
  5. Wiz Research · October 21, 2026 · https://wiz.io/blog/php2shell-php-rce
  6. Reuters, Raphael Satter, via Honolulu Star-Advertiser · October 19, 2026 · https://www.staradvertiser.com/2026/10/19/breaking-news/how-one-hacker-used-ai-agents-to-break-into-over-100-company-websites/
  7. The Next Web, Ana Maria Constantin · October 19, 2026 · https://thenextweb.com/news/ai-agents-hacker-cairn-100-sites-deere-norforge
  8. Insurance Business, Matthew Sellers · October 21, 2026 · https://www.insurancebusinessmag.com/us/news/cyber/nsa-warns-of-critical-website-flaw-as-wikipedia-european-government-websites-taken-offline-594432.aspx
  9. TechCrunch, Aditya Mehta · October 19, 2026 · https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/
  10. Cloud Security Alliance research note · October 19, 2026 · https://labs.cloudsecurityalliance.org/research/csa-research-note-cert-in-ai-agent-unauthorized-access-20261/
  11. CNBC · October 23, 2026 · https://www.cnbc.com/2026/10/23/php-vulnerabilities-ai-cybersecurity.html
  12. Axios · October 22, 2026 · https://www.axios.com/2026/10/22/php-vulnerability-security-update-websites
  13. X, @AISafetyMemes · October 22, 2026 · https://x.com/AISafetyMemes/status/2113113711644737835
  14. Nippon.com (Jiji) · October 21, 2026 · https://www.nippon.com/en/news/yjj2026102101249/
  15. OfficeChai · October 21, 2026 · https://officechai.com/stories/japans-prime-minister-usas-fbi-take-to-x-warning-people-over-the-php-vulnerability/
  16. Tech-ish · October 21, 2026 · https://tech-ish.com/2026/10/21/japans-pm-the-nsa-and-the-fbi-tell-websites-to-update-php-or-go-offline/
  17. BNN Bloomberg and others · October 21, 2026 · https://www.bnnbloomberg.ca/business/politics/2026/10/21/some-government-websites-taken-down-in-response-to-security-risk-ai-minister
  18. PPC Land · October 2026 · https://ppc.land/cloudflare-blocks-php2shell-exploits-9-hours-before-php-flaws-went-public/
  19. The Hacker News, Ravie Lakshmanan · October 23, 2026 · https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html
  20. EcomCrew, Alexa Alix · updated October 23, 2026 · https://www.ecomcrew.com/php2shell-is-leaking-api-keys-from-ecommerce-servers/
  21. The Hacker News, ThreatsDay roundup · October 22, 2026 · https://thehackernews.com/2026/10/threatsday-ai-secrets-leak-pingcap.html
  22. Wiz · October 21, 2026 · https://www.wiz.io/blog/litellm-compromised-steals-credentials
  23. Datadog Security Labs · October 2026 · https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-docker.md
  24. Socket · October 2026 · https://socket.dev/blog/litellm-compromise
  25. BleepingComputer · October 2026 · https://bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks
  26. Railway blog, Jacob Cooper · October 21, 2026 · https://blog.railway.com/p/security-disclosure-wednesday-october-21st
  27. BleepingComputer · October 20, 2026 · https://www.bleepingcomputer.com/news/security/zeabur-shutting-down-after-second-security-breach-in-two-months/
  28. Zeabur official · October 2026 · https://zeabur.com/zh-TW/blogs/october-2026-security-incident
  29. sunglasses.dev · October 23, 2026 · https://sunglasses.dev

Frequently Asked Questions

sunglasses://reports/black october php2shell ai key heist 2026#faq
Q.01

What is Black October?

A community label, not one attack, for a cluster of security incidents and disclosures between about October 19 and 22, 2026. The name spread from a viral X post on October 22. [3, 2, 13]

Q.02

What is PHP2Shell?

Two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2. They let an attacker take over a web server without logging in, or read its memory. [5, 8]

Q.03

Has PHP2Shell been widely exploited?

Not so far by current reporting. Cloudflare's CEO cited millions of attempts, but 404 Media and Australia's cyber agency reported no widespread exploitation. [1, 8, 19]

Q.04

Does updating WordPress fix PHP2Shell?

No, the flaw is in the PHP runtime, so the runtime itself must be patched. Rotate keys afterwards, because a patch does not revoke keys already read from memory. [5, 20]

Q.05

How did AI agents break into company websites?

Reuters reported a Chinese-speaking hacker ran AI agents on the open-source Cairn platform against more than 1,200 sites and got into over 100. The instructions were under 100 Chinese characters. [6, 7]

Q.06

Why were AI API keys a target?

Stolen keys run up charges on the owner's AI accounts, as OpenCode users saw, some over $1,000. Railway called its breach part of a series aimed at AI inference providers. [9, 26]

Q.07

Would Sunglasses have stopped Black October?

No, not PHP2Shell, OpenCode, LiteLLM, the platform breaches or the Cairn hacker. It guards the agent: it scans what the agent reads and blocks keys leaving through tool calls. [29]

Related reading

Scan what the agent sees, before it acts

Sunglasses is an open source input filter for AI agent security. It blocks prompt injection before your agent reads it. pip install sunglasses

GitHub Install