Black October: AI found a 10-year-old hole in the web

Full transcript

The video's narration, word for word, by chapter.

0:00 Black October

Here is something that really surprised me. For more than ten years, a hole sat in the code behind a huge part of the web. One of the flaws was even spotted in 2024, but it was never fixed. This summer, AI helped find them again. Security experts actually have a name for this month: Black October. In the next five minutes, I will show you what happened, what the AI really did, and what it means for you if you use AI agents. I am Ashu, and this is Leashtra.

0:36 Ten years inside PHP

To understand this, let's start with PHP. It is the code language behind a huge number of websites: online shops, blogs, login pages. When you open a web page, there is a good chance PHP made it. Deep inside PHP, there were two small mistakes in how it uses memory. They were there for more than ten years.

0:58 How AI found the flaws

Then, in August, AI helped two security teams find them. A team called Calif used OpenAI's AI and found one of the flaws. Working separately, researchers at a company called Wiz used AI and found both. OpenAI, whose AI helped with the work, said that as far as they know, AI found these flaws before attackers did. Honestly, that is a relief.

1:22 The fix and the race

On October twentieth, the PHP team warned everyone: an urgent fix is coming tomorrow. And this was serious. On the scale that experts use, each of the two flaws scored nine point two out of ten. On the twenty-first, the fixes came out. And then the race began. Because the moment a fix is public, attackers can study it to find out where the hole was. From that moment, every website that has not updated is a target. The news site Axios reported that the NSA, a United States security agency, told website owners: if you cannot update fast, take your site offline. Imagine being told to switch off your own website. Dozens of sites did exactly that. And security companies, including Cloudflare, said attackers were already trying to use the flaws.

2:12 Why it matters

So what can someone actually do with a flaw like this? In simple words: a stranger sends one request to a website, and the website's server runs the stranger's code. Not your code. Theirs. What worries me is this: on some common setups, PHP's own warning says this can happen before the website's own code even starts. So a well-built website was not enough. The ground under it was cracked. Wiz called these some of the most serious flaws ever found in PHP. Strong words, especially coming from the people who found them.

2:50 PHP was not alone

And PHP was not alone. On October thirteenth, Microsoft released more than fourteen hundred security fixes in one month. That is a record. One of those flaws was already being used in real attacks. It was the fourth record month in a row. According to the reports, one reason is that Microsoft now uses AI to check its own software, and the AI keeps finding more.

3:15 How the AI was used

Now here is the part that matters most. The AI that found these holes is the same kind of AI that anyone can use. This time, the good side used it first. But nothing stops an attacker from pointing it at the next piece of software. Which AI was it? Wiz says it used its own AI tool together with AI models from Google and OpenAI. And one thing is clear: the speed. AI now finds holes faster than people can fix them. Think about that for a second.

3:45 The leash

And this is where this channel comes in. An AI agent is an AI that can take actions: run commands, change files, use online services. Give that power to an agent with no limits, and you have built the attacker yourself. So, five things. Limit: give the agent only what it needs. Enforce: put the rules in the tool, not just in the prompt. Audit: record every action it takes. Secure: keep your real passwords and keys away from it. And Human: a person says yes before anything big.

4:19 What to do today

If your website runs on PHP, update it today to one of the versions on screen. If you are on PHP 8.1 or older, the PHP team no longer sends fixes for it, so talk to your hosting company now. And if you use AI agents, check what they can reach. Today, not next week.

4:36 Closing and what's next

Black October is not the end of something. It is the start. AI is now part of security on both sides, and the winners will be the people who keep their AI on a leash. All the sources are in the description. And coming soon on this channel: your AI agents do real work all day, and the next morning, they forget all of it. We built something to fix that. It's called WWW. Every AI wants to be an Astra. We give it a Leash.