BLACK OCTOBER

I found out something was going on this week the way a lot of people did. I tried to clock in for work, and ADP wouldn't let me.

Couldn't clock in. Couldn't clock out. Just a payroll page that wasn't loading, in the middle of a week where it felt like half the internet was either down, patching or posting about patching.

To be clear, I have no idea if ADP's problem had anything to do with what I'm about to explain. Nobody has said so publicly, and I'm not going to guess. But it set the tone for a week people in security are already calling Black October.

What actually happened

The main event is called PHP2Shell.

PHP is the programming language that runs behind a huge chunk of the internet. It's used by about 69% of websites whose server-side language is known, including every WordPress site. (If you're not sure what PHP even is, I wrote a plain-English explainer: What Is PHP?)

On October 20, details leaked about two critical bugs in PHP itself. Not in one website or one plugin. In the engine underneath all of them. Both bugs were rated 9.2 out of 10 for severity, and they share the worst possible combo: an attacker doesn't need a password, and a single crafted request could let them run their own code on the server.

Translation: if your website runs PHP and nobody updated it, a stranger could potentially take over the computer it lives on.

The plan had been to fix it quietly and announce it on the 22nd. The leak blew that up. PHP pushed out emergency updates on October 21, and attackers were already trying the bugs before the fixes were even public.

The scramble

This is the part that felt like the internet holding its breath.

Government cybersecurity agencies, including the NSA and the UK's National Cyber Security Centre, told organizations to patch immediately or take unpatched systems offline. Some big sites did exactly that. 4chan, some of Wikimedia's cloud services and the Internet Archive went down temporarily while they updated.

Cloudflare, which sits in front of a lot of the web, switched on firewall rules against the attack by default, for every customer including free accounts, hours before the official patch was out. Then they watched attackers change their payloads to try to get around the rules. It was a live game of whack-a-mole, out in the open.

Why it's called Black October

PHP2Shell wasn't alone. In the same few days:

• Node.js, the other giant behind a lot of websites and apps, shipped fixes for serious bugs, including one that could let an attacker run code.
• GitLab, where a lot of companies keep their code, patched a flaw rated a perfect 10 out of 10.
• LiteLLM, a popular tool developers use to connect apps to AI models, had a poisoned version published that tried to steal passwords and keys. It was pulled in about two hours, but two hours is a long time on the internet.
• eMudhra, a company that issues the security certificates behind the little padlock in your browser, had keys so weak that the major browsers moved to stop trusting them.
• Plex, the home media server a lot of people run in their living room, had a bug attackers were actively using to install crypto miners.

Any one of those would be a normal bad week in security. All of them at once, stacked on top of PHP2Shell, is how you get a name like Black October.

The AI part

Here's the piece I can't stop thinking about.

The PHP bugs were found by researchers at Wiz, Calif and OpenAI's security team, and they've said AI helped them turn the bugs into working attacks in about a week, work that would normally take months. Another company published fixes early and said it had found the same bugs on its own, also using AI.

That's good news and bad news in the same sentence. The good guys can find old bugs faster than ever. So can everybody else.

I wrote a while back that AI is a tool, not a coworker. This week is that idea with the stakes turned all the way up. The tool doesn't care who's holding it.

So what should you actually do?

Most people reading this don't run a web server. Here's what matters for you.

If you have a website:

• Find out if it runs PHP. WordPress, WooCommerce, Joomla, Drupal and a lot of custom sites do. Squarespace, Wix and Shopify handle their own servers, so that's on them.
• Ask your host if PHP is patched. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updating WordPress doesn't update PHP. Those are two different things, and this week a lot of people found that out the hard way.
• If you're on PHP 8.1 or older, it's out of support, and you need a real upgrade plan, not just a patch.
• Put something in front of your site. A free Cloudflare account was one of the fastest protections available this week.

If you're just a person with accounts (so, everybody):

• Update everything. Phone, computer, browser, router, and that Plex server in the closet.
• Expect weird outages and slow sites for a few days. A site being down for maintenance this week is usually a good sign. It means somebody's patching.
• Watch for scams riding the news. "Your account was affected by a security incident, click here" emails always show up after a week like this. Go to the company's site directly. Don't click the link. (More in How to Spot a Tech Support Scam.)
• If a service you use says it was breached, change that password and turn on two-step verification. Our two-factor guide walks through it.

For the record, us

People asked, so here's the answer: m1ygrndn.com doesn't run PHP at all. It's plain files on Cloudflare, and the chat and contact form run on a separate system that isn't PHP either. We checked anyway, because that's the job.

The part nobody likes

The PHP bugs were sitting there for years. They reach back to versions of PHP from more than a decade ago. Nobody noticed until somebody pointed a new kind of tool at them.

That's the real lesson of Black October. The internet is held together by old code, volunteers and a lot of people who will never get thanked for patching servers at 3 in the morning. This week, they held it together.

Go update your stuff. And if ADP lets you, clock in.

— g