‘Black October’ hacks explained: what’s AI, what isn’t, what to do

“Black October” is a nickname, not an attack. It’s the label social media gave to a pile-up of seven unrelated security incidents that TechCrunch listed on October 21, under the headline “The internet is having a very bad cybersecurity day.”

The internet isn’t under one coordinated assault. AI played a part in only two of the seven, and in both cases it helped researchers find bugs that then got fixed. Most of the repair work this week falls on web hosts, software makers and IT teams. For most people, it comes down to a few minutes of updates.

Where the ‘Black October’ label came from

We couldn’t find anyone who coined the phrase. It shows up in social posts and blogs from October 22 onward, and never in an official advisory.

One widely shared Substack note from October 22 said “some are calling it Black October.” It then listed 27 incidents and told readers to expect “internet lockdowns.” Nothing in the advisories we read supports that prediction. The Indian tech site Sify described the name as a nod to the number and severity of events, “not to any coordinated campaign.”

The timing also makes things look worse than they are. Several of these problems started weeks ago, and only their disclosure landed this week.

The seven incidents, sorted by what actually caused them

We checked each item on TechCrunch’s list against the company’s own advisory or a second outlet. Here is what drove each one, and who has to act.

Five of the seven come down to familiar failures: stolen logins, a botched script, a lookalike code repository, unpatched servers and a state-linked spying campaign.

The two cases where AI really did matter

PHP2Shell is the big one, and we covered it in our explainer on the PHP flaw and who has to fix it. The PHP Foundation says researchers at Calif, OpenAI and Wiz each reported the core bug in August. OpenAI said Calif used its tools to find the flaws, The Record reported.

The NSA’s advisory told organizations that couldn’t update right away to take systems offline. That advice is why some government sites went dark.

The Node.js case is smaller. The project’s October security release credits “OpenAI Codex Security” among three reporters of a bug in its Brotli decoder. That flaw could allow remote code execution. Human researchers reported the other three high-severity bugs.

In both cases, AI sped up discovery for defenders, and the fixes shipped. The worry is what comes next. The PHP Foundation says AI-assisted research means its team “receives far more reports than before.” It adds: “Tools now find bugs faster than ever, for defenders and attackers alike.” The Record also reported that the security firm watchTowr saw exploit code for PHP2Shell that had been “vibecoded” with AI help.

LiteLLM, eMudhra and the rest were old-fashioned failures

LiteLLM sounds like an AI story, but the attack was a classic software supply-chain trick. The project’s own incident report says version 1.107.0 was built from a lookalike repository.

According to the security firm Aikido, the bad package sat on PyPI for about an hour on October 21 and on Docker for longer. It stole cloud credentials, SSH keys and AI service keys. Developers who installed it should rotate those secrets.

eMudhra is an Indian certificate authority, one of the companies that vouch for websites’ padlock icons. Eight of its intermediate certificates had private keys so weak that one of them was literally the number 4, the researcher Scott Helme found, The Register reported.

eMudhra blamed an error in a key-generation script, according to BleepingComputer. Mozilla and Google blocked the certificates on October 17, and Apple followed on October 22. Neither outlet reported evidence that anyone abused the keys. Our eMudhra explainer has the full story.

The other three are slower-burning. PingCAP, the company behind TiDB Cloud, said on October 19 that an intruder used stolen service-account credentials. The intruder copied account details, billing data and encrypted API keys, though PingCAP says there’s no evidence customer databases were touched.

Plex fixed the Plex2Shell bugs on August 4. Attacks began after exploit code went public, and they install cryptocurrency miners on unpatched servers, The Hacker News reported. CISA gave federal agencies until October 23 to patch, BleepingComputer reported.

BeyondTrust’s Remote Support flaw has been exploited since August 29, according to Rapid7. Google’s threat intelligence team links it to a suspected China-linked espionage group, BleepingComputer reported. That one targets companies, not households.

Four things a normal person should do this week

None of this requires panic. These steps cover what’s within your control:

1. Install pending updates on your phone, computer and browser. That is how the eMudhra block reaches you, and how most of this week’s fixes arrive.
2. Use a different password for every account and turn on two-factor authentication. Breaches like TiDB Cloud’s start with stolen logins. If a service emails you about a breach, change that password first.
3. Update the gear you run at home. If you run a Plex Media Server, make sure it’s on version 1.43.3.10861 or later. Check your router too, especially an AT&T or CenturyLink gateway named in our Broadcom Wi-Fi flaw report.
4. Don’t read a maintenance page as a hack. A site offline this week is most likely patching. Malwarebytes advises leaving any familiar site that suddenly asks you to log in again or pushes a download.

The steady stream of fixes won’t stop soon. Microsoft’s next scheduled monthly security update lands on Tuesday, November 10, the second Tuesday of the month, when Microsoft releases its regular patches, and the PHP Foundation expects AI-assisted bug reports to keep rising.