'Black October': PHP2Shell Exploit Hits ~70% of Websites — and AI Agents Are Doing the Driving
Palo Alto's Unit 42 confirmed a PHP2Shell compromise in which an AI agent took over after the shell landed, automating post-exploitation at machine speed. Combined with the Brotli RCE, it's a grim month for the infrastructure agents increasingly run on.
A security episode now being called "Black October" is forcing the agent community to confront a new threat model: the AI isn't just the target, it's the attacker's automation layer. Palo Alto Networks' Unit 42 has a confirmed PHP2Shell compromise in which, as @catcowbug put it, "an ai agent was doing the driving after the shell landed." In other words, once the exploit established a foothold, an AI agent handled post-exploitation — reconnaissance, lateral movement, and credential harvesting — without a human at the keyboard.
Unlock the full briefing
Get every story in today's briefing, the full archive, and the daily AI intelligence brief.
All stories today
Full archive
Daily brief
Cancel anytime. Payments powered by Stripe.