3-Line TL;DR

  • October alone brought emergency PHP and Node.js patches and a ConnectWise breach, all with AI somewhere in the story
  • Attacks start about 3 days after disclosure on average, while fixes take weeks
  • For large services, an always-on agent probably needs to work like an antivirus alongside the team (author's opinion)

What happened in October?

  • On Oct 21, PHP fixed two core flaws that can let attackers run commands on a server without logging in (PHP notice)
  • The UK's NCSC said any web server running PHP could be at risk and urged immediate action (NCSC)
  • One security vendor said its own AI produced a working proof-of-concept exploit (OrcaRouter)
  • Its research post, though, describes a modified reproduction of an existing public exploit, not an AI finding the bug on its own
  • The same day, Node.js fixed a Brotli decompression flaw that OpenAI Codex Security had found (Node.js)
  • Microsoft attributes the ConnectWise Cloud Backup breach to a group it calls Storm-0940 (Microsoft)
  • Microsoft says the group has automated attacks with an agentic AI tool, ARTEX, since September, sometimes reaching cloud admin access in under 3 hours
  • Another story that spread: Claude Code catching a crypto miner hidden on a Mac (Tom's Hardware)
  • A user building a temperature app saw odd sensor readings, and the agent found XMRig using 12 cores at 112°C (Reddit)

Timeline of AI attacks and defenses from July to October 2026, from JADEPUFFER and the Mac miner to the ConnectWise breach and PHP and Node.js patches

Made by HSL from coverage of Microsoft's report, Microsoft's Storm-0940 analysis, ConnectWise advisories, Google DeepMind, Codex Security Cloud coverage, PHP and Node.js

  • The common thread in October: AI showed up on both the attack side and the defense side
  • Google also sees attackers moving from simple prompting to autonomous multi-agent operations (Google Threat Intelligence)

Why is it harder to defend now?

  • The core problem is speed: attacks take days, patches take weeks
  • Rapid7 tracked 43 newly exploited high-risk flaws in Q3 and found an average of 3 days from disclosure to exploitation (Rapid7)
  • 71% were exploited within 7 days, and 79% needed no login or user click
  • On the other side, median patch time is 43 days (Verizon, as cited) and 87 days for exploited flaws (Moody's, as reported)

Bar chart comparing 3 days from disclosure to first exploit with 43 days to patch a known flaw and 87 days to patch an exploited flaw

Made by HSL from Rapid7 Q3, Verizon DBIR as cited and Moody's as reported. Methods differ, so read the gap rather than the exact ratio

  • As a market example, one survey found 82% of version-identified PHP servers in South Korea run end-of-life releases (Dailian)
  • End-of-life versions get no patch at all for flaws like these
  • In June, the US agency CISA rewrote its federal patching directive and named AI as a reason defenders have less time

CISA BOD 26-04 capture highlighting that attackers' AI use may narrow defenders' time, and the test asking if every exploit step can be automated

Source: CISA BOD 26-04, our own capture of the original text; red outlines added by HSL

  • One of its new priority tests asks whether an attacker can automate every step of the exploit
  • There is no evidence yet that AI-found flaws are exploited more often (VulnCheck)
  • VulnCheck counted 1,061 flaws found with AI help, and only 14 (1.3%) had confirmed exploitation

So is there no way to stop it?

  • In my view, large services need an always-on agent that also works as a security antivirus to stay safe (author's opinion)

  • A team that reads patch notices after arriving at work can't keep pace with attacks that land within 3 days

  • Products are already heading that way

  • OpenAI Codex Security scans repositories on every commit, checks findings in a sandbox and proposes patches (OpenAI)

  • In late September, Codex Security Cloud arrived and keeps watching from the cloud even with the laptop closed (coverage)

  • Google's CodeMender upstreamed 72 security fixes to open-source projects in six months, with a person reviewing every patch (Google DeepMind)

  • Microsoft's threat-detection agent keeps correlating alerts and anomalies in the background (Microsoft docs)

Flow of an always-on security agent: watch, find, prove in a sandbox, draft a fix, human approves, and alert a person first during a live attack

Made by HSL, simplified from how Codex Security and CodeMender describe their flow

  • What they share: they watch nonstop, but a person approves the fix
  • The agent itself becomes a target, since hidden instructions in code comments can mislead it, so its access must stay narrow (Mandiant)
  • So even an "antivirus" agent needs the least privilege possible and a log of everything it does

A robot guard-dog agent squints at a 'let me in :)' note on a server door while a person with coffee holds its leash

The agent sniffs, the human decides

Size Do this first
Personal blog or small site Turn on automatic updates, switch off unused features, ask how fast your host patches
Development team Always-on repo scanning, automated dependency updates, retire end-of-life runtimes
Large service Always-on detection agent plus human approval, least-privilege agents, action logs

Sources: Australian government guidance for small businesses on AI-enabled attacks, Mandiant, Microsoft docs; summarized by HSL

  • Australia's government also tells small businesses to start with automatic updates, fewer exposed features and code scanning
  • The realistic setup: match AI attacks with AI defense for speed, and keep the final call with a person

Community Reactions

  • r/ExperiencedDevs' tommyk1210 says their team, which upgrades PHP annually, patched hundreds of containers by 8 p.m. this time (Reddit)
  • r/cybersecurity's House_Indoril426 reports no unusual attacks yet and cannot confirm AI involvement in a recent vendor-impersonation incident (Reddit)
  • r/cybersecurity's CyanCazador worries that executives may treat AI security tools as a replacement for security fundamentals (no measurements) (Reddit)
  • Hacker News' tibbar argues that a real PHP RCE can still require a good harness and verification to prevent an LLM from cheating (no measurements) (Hacker News)

Q&A (Field Notes)

  • Q. My blog runs on PHP. What should I do now?
    • Check you're on PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later; if you can't, ask your host whether it has patched
  • Q. What if I'm on PHP 8.1 or older?
    • No patch is coming. PHP says upgrading to a supported version is the only real fix
  • Q. Will an AI security agent apply patches for me?
    • Codex Security and CodeMender only draft fixes; a person reviews them before anything ships
  • Q. Is installing antivirus enough?
    • Australia's guidance says antivirus alone won't stop every threat; add updates, MFA and backups (Australian government)