This post was originally published in Portuguese on my blog: Black October: a IA acelerou a caça às falhas, e a conta chegou .

October is officially Cybersecurity Awareness Month. In 2026 it earned a much less friendly nickname: Black October . In just a few days we saw a critical PHP flaw discovered with the help of AI, a certificate authority leaving the market because of private keys you could practically guess, and a popular AI library distributing malware through PyPI. If you work with software and didn't have to update anything in the last few weeks, you were either very lucky or didn't look closely.

What happened

The loudest episode was PHP2Shell . Researchers at Wiz, with support from OpenAI and Calif, found memory-safety flaws in the PHP core, tied to how the language handles fatal errors, mainly memory exhaustion. A failing request can leave corrupted internal state behind, which another request later reuses. The result is unauthenticated remote code execution, with severity scores up to 9.2.…