Black October? What is true and what you can do today
A viral post warns of AI agents attacking the internet. I checked the core claims. Much of it holds up, the tone does not. And this is what actually helps.
Translated from the German original with an AI language model, approved by me. Read the original
There is a post going around right now that a lot of people are getting forwarded: "Something Big Is Happening" by Matt Shumer. The message: swarms of AI agents are attacking the internet, send this to everyone you know.
I looked at the core claims. In short: the situation is serious. The post is louder than the facts.
What holds up
PHP2Shell. Two flaws in PHP, the software behind a large share of all websites, severity 9.2 out of 10. Exploiting them lets an attacker run their own code on the server without logging in. The patches came out on October 21. The flaws were found by researchers at Wiz together with Calif and OpenAI, using AI-assisted tools, and reported back in August. (Recorded Future)
Amazon saw a first attempt in its honeypots, servers that exist only as bait for attackers, on October 17. Four days before disclosure. Amazon now speaks of broad exploitation, Cloudflare of a sharp rise in attacks. According to Help Net Security, a working exploit shows that a single request without login is enough. None of the reports I read names a confirmed successful break-in so far, though. Amazon's find from October 17 also hit a bait server. (The Register, Techzine, Help Net Security)
Governments pull sites offline. Germany, the Netherlands and other countries took websites offline as a precaution, and Wikimedia some of its systems. According to the German digital ministry, no incidents were known there. Switching off was caution, not a break-in. (CNBC)
One attacker, more than 100 companies. According to Reuters and researcher Snorre Fagerland, a single attacker used AI agents on the Cairn platform to break into the websites of more than 100 companies, including Deere and SharkNinja. Cost: about 5,000 dollars, roughly 50 dollars per successful break-in. How much data was taken is unclear. Deere says it sees no sign that sensitive data was accessed. (TNW)
Banks lock out AI agents. JPMorgan no longer lets outside AI agents into customer accounts. According to Jamie Dimon, anyone who hands their login to an agent carries the risk themselves. (Cybernews)
What I could not confirm
- That the claim "half of the servers are too old for the fix" comes from Cisco. A similar number does exist, more on that below.
- The quote that bank executives called the situation "horrifying".
- Other numbers in the post (Latin America, South Korea, Japan) I did not check, so I leave them out.
Half too old? Handle the numbers with care
A Shodan count cited by the security firm CybelAngel: of about 1.5 million servers that openly show their PHP version, 59 percent (883,717) run a branch with no official update. So the "half" in the post is not made up. (CybelAngel)
But these scanners count version numbers, not vulnerabilities. Linux distributions like Ubuntu build the fix into their own packages and keep the old version number. A server I look after reports "PHP 8.3.6". That sounds years old. The package does contain the patch for exactly these two flaws, installed the morning after disclosure. A scanner still counts it as vulnerable. The real number is lower. By how much, nobody knows exactly.
For PHP 7.4, 8.0 and 8.1 there are only minimal source code fixes, meant for people who build PHP themselves. If you sit on one of those versions at a hosting provider, they do not help you.
What is off about the post
"Black October", "send this to everyone", cash and supplies at home: that is alarm. Yet Shumer himself writes that no successful break-in through the PHP flaw has been confirmed so far.
The advice to avoid small websites is well meant but not workable in everyday life. And deposit insurance depends on where you live: in Germany and the EU, deposits are protected by law up to 100,000 euros per customer and bank, in the US the FDIC covers 250,000 dollars.
What you can do today
- Install updates. Phone, computer, browser and router. Never an "update" from a pop-up, a text message or an email.
- Use a password manager. Every account gets its own password. iPhone and Android have one built in.
- Turn on two-step login, email and bank first. Your email is the master key to everything else.
- If "your bank" calls, hang up and dial the number on your card yourself. No bank asks for a one-time code or your password.
- Do not give banking logins to AI assistants or other apps, even when it would be convenient.
- Do not pull your money out. Panic is exactly what scammers count on.
If you run a website on PHP yourself: check your version and update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Amazon recommends reviewing logs from October 17 onward, not just from the disclosure date. For 8.1 and older there is no ready-made update: upgrade, or ask your hosting provider or distribution. On Ubuntu and Debian the old version number stays, apt changelog php8.3-common (with your version) shows whether the fix is in. If your site is behind Cloudflare, you get firewall rules against the known attack paths, on the free plan too. That does not replace the update.
Faster, not unstoppable
Attackers have gotten faster because AI does part of the work for them. That is real. The answer is not panic, though, but the boring stuff: updates, unique passwords, a second factor.
The first 48 hours of this week are also a video: The 48 Hours, Episode 1.