The disclosure of two severe vulnerabilities in the core of PHP has triggered a worldwide surge of automated exploit attempts, an event rapidly labeled 'Black October' across the cybersecurity industry. Tracked under the identifiers CVE-2026-109618 and CVE-2026-109619, both flaws carry a critical CVSS severity rating of 9.2. Because they permit unauthenticated remote code execution on web servers, the real-world danger is immediate and profound. With PHP underpinning roughly 70 percent of all websites across the globe, millions of internet-facing installations were exposed to hostile takeover.
What makes the incident unprecedented is how the flaws were initially discovered. Rather than emerging from routine manual penetration tests or legacy fuzzing tools, they were uncovered through OpenAI's 'Patch the Planet' initiative. Researchers from the Calif team utilized OpenAI's GPT-5.6 Sol model to audit the code base. In a parallel effort, cloud security firm Wiz discovered identical vulnerabilities using its own AI-assisted security analysis tooling. This convergence highlights how advanced reasoning models can now methodically dissect decades-old C and PHP code, spotting complex logic errors that human auditors overlooked for years.
However, the coordinated vulnerability disclosure pipeline fractured before software maintainers could roll out official fixes to the wider community. Technical details regarding the flaws leaked prematurely into the public domain, triggering an immediate and violent exploitation phase. Malicious actors promptly integrated the leaked proof-of-concept mechanisms into automated botnets and scanning engines. What had started as a showcase for AI-powered defensive security rapidly deteriorated into an emergency response race for systems administrators and web hosts.
Matthew Prince, the chief executive officer of web security and content delivery giant Cloudflare, revealed the alarming scale of the unfolding attacks. According to Prince, Cloudflare's global infrastructure observed thousands of exploit attempts ten hours before the official security patch was scheduled for release. Within just two hours of the initial leak, that volume exploded into hundreds of thousands of requests, before quickly surging into millions of automated attack probes aimed at web properties worldwide. The data illustrates how rapidly offensive operations can mobilize once actionable flaw data is surfaced.
The episode highlights the escalating dual-use dilemma inherent to AI-driven vulnerability research. While defensive agents such as GPT-5.6 Sol dramatically accelerate the discovery of latent vulnerabilities in legacy software, they inadvertently widen the exposure window for defenders. Open-source maintainers and corporate IT teams cannot match the speed of automated scanning pipelines. When the interval between machine-assisted flaw discovery and automated weaponization shrinks to mere hours, established vulnerability disclosure frameworks cease to function effectively.
Cybersecurity experts now view 'Black October' as a turning point for web infrastructure defense. The classic patch management lifecycle, which relies on manual code reviews, test builds, and gradual administrative rollouts, is manifestly unsuited for an era dominated by automated exploit agents. Moving forward, defenders will be forced to adopt autonomous vulnerability remediation and self-healing systems. Without such automation, the widening asymmetry between rapid algorithmic discovery and slow human patch deployment will present a recurring systemic risk to the open web.