“Black October” Explained: What AI-Driven Cyberattacks Mean for Your Business

October brought an unusual run of serious security events: an emergency fix for a decade-old flaw in PHP, the software behind a large share of the web, and a Microsoft report of a state-aligned group using AI to break into cloud environments at what it called machine speed. By the end of the month the stretch had a nickname, “Black October,” and the national business press had picked it up.

The label suggests one coordinated attack. The month actually produced several largely unrelated incidents, and the useful question for a business owner is what they have in common. In most of them, attackers moved on a weakness faster than many organizations are prepared to respond, and that applies to a 40-person firm in Greater Sacramento as much as to a federal agency.

What Happened in October

The incident that drew the most attention was PHP2Shell. On October 21, the PHP project released fixes for two critical flaws that could let an attacker run code on a web server without logging in. According to the PHP Foundation, the first signs of the underlying problem surfaced during a 2024 security audit, and reports from the research firms Calif and Wiz and from OpenAI in August and September made its full severity clear. The FBI issued a public alert on October 23, and on October 26 CISA added both flaws to its catalog of vulnerabilities known to be exploited in real attacks. We covered what that meant for local businesses in our PHP2Shell post.

The second major thread involved ConnectWise, a widely used provider of IT management and backup software. On October 16, ConnectWise disclosed unauthorized access involving its Cloud Backup service. Five days later, Microsoft said it assesses that a China-state aligned group it tracks as Storm-0940 was responsible. According to Microsoft, the group obtained credentials for ConnectWise cloud applications that customers had already authorized to connect to their Microsoft 365 environments, then attempted to sign in to more than 2,250 of those environments. Most of the attempts failed. In some organizations, though, the attackers reached privileged access, meaning administrator-level control over accounts and settings, in multiple cases less than three hours after first targeting them. Microsoft also cautioned that a successful sign-in does not necessarily mean data was accessed.

A smaller incident showed how AI tools themselves can become a point of exposure. On October 17, the AI coding tool OpenCode told a subset of users that AI provider keys stored in its hosted console may have been exposed, and some of those users reported unauthorized charges.

Where AI Actually Contributed

The clearest documented use of AI by attackers is Microsoft’s account of Storm-0940. Microsoft reports that the group used ARTEX, an “agentic AI penetration testing framework.” In plain terms, it is software that uses AI to automate many of the individual tasks in an attack. In this campaign, the group chose its targets and used the tool to speed up work it already knew how to do: reconnaissance, password guessing, and the abuse of trusted applications across hundreds of organizations. Each technique was familiar for this group. What the tool added, according to Microsoft, was agents that work around the clock and try several approaches at once.

AI also played a substantial role on the defensive side. The PHP Foundation says it scanned PHP with an Anthropic model and uses an OpenAI tool to help validate incoming reports, and research by outside firms, some of it AI-assisted, is what established how serious the PHP flaws were. The Foundation’s own summary is balanced: tools now find bugs faster than ever, “for defenders and attackers alike.”

“AI is making the old vulnerabilities cheaper to discover and exploit, but on the other side, the defense side… that’s not sped up as much.”Junfeng Yang, Columbia University, speaking to Fortune

Much of what circulated online went further than the evidence. Posts describing fully autonomous AI hacking campaigns or coming internet shutdowns are not supported by the primary reports, which describe people choosing targets and directing tools. Some early claims of successful PHP2Shell attacks also proved premature. The Register reported that Sophos walked back its initial assessment after concluding it had seen scanning and failed attempts, and that Palo Alto Networks withdrew a claim linking the flaws to an intrusion at a European government agency. Junfeng Yang, a computer science professor at Columbia University, told Fortune that some of the month’s most impactful incidents “had nothing to do with AI.” His example was eMudhra, a certificate authority, one of the companies that issue the digital certificates browsers use to confirm a website is genuine. Its keys were generated so weakly they could be recovered almost instantly. Browser makers blocked the certificates, and eMudhra says it found no evidence of misuse. The relevance for a business owner is that a basic configuration mistake did as much damage to trust as any AI-assisted attack, which is why the checks below concentrate on fundamentals.

Where the Time Actually Goes

PHP2Shell offers a clear timeline. Amazon’s threat intelligence team recorded an exploitation attempt against its decoy servers on October 17, four days before the flaws were publicly disclosed, and saw new exploit code appear within hours of the patch. Amazon was careful to add that it was unclear whether those attempts would have succeeded against real systems. CISA said on October 21 that it had not yet observed exploitation; five days later, it listed both flaws as actively exploited, without saying how many organizations had actually been compromised. Researchers continue to debate how reliably the exploits work against real production servers, but the window between “a fix exists” and “attackers are trying it” was measured in days.

For a small business, the time it takes to close that window is usually spent in three places. The first is learning that a fix matters: someone has to notice the advisory and recognize that it applies to your website or firewall. The second is deciding: someone has to approve a restart or a brief outage, often at an inconvenient moment. The third is applying the fix and confirming it worked. In most 20 to 100 person organizations, the technical step is the fastest of the three. The delays come from unclear ownership, such as an IT provider waiting for approval that nobody knows they are supposed to give.

Microsoft’s data on the related password-guessing campaign shows the other side of the problem. Between October 10 and 14, it recorded more than 151,000 failed sign-in attempts against 327 accounts at eight organizations, peaking at about 2,900 a minute. Microsoft observed no successful sign-ins in that campaign. Automated volume like that is a search for exceptions: the one account without multifactor authentication, the server that missed an update, the application with more access than it needs.

Those exceptions are not new risks. Monthly patching of internet-facing systems, executives exempted from MFA, and connected apps nobody reviews have contributed to breaches for years, long before AI tools were involved. What automation changes is how efficiently attackers can find them across thousands of organizations at once. Amazon now advises measuring the response time for critical, internet-facing vulnerabilities in hours. A practical way for a small business to approach that standard is to agree in advance with its IT provider on who can authorize emergency fixes and how quickly exploited flaws will be addressed, so the decision is already made when the next advisory arrives.

5 Security Checks Every Business Should Make This Week

Each of the checks below comes with a question that business leadership can put directly to its IT provider or internal IT staff. The answers will show quickly where the gaps are.

Looking Past the Name

“Black October” will likely fade as a label. Joseph Steinberg, a cybersecurity consultant quoted by Fortune, suggested the month may not look especially significant in hindsight, since new technology has always created new problems that the field eventually learns to manage.

What the month makes clear is that readiness depends on ownership. The questions it raised are practical ones: who knows which applications can reach your email and files, who can approve an emergency fix on a Friday afternoon, and who has restored a backup recently enough to trust it. Attack tools will keep improving. A business that has named owners for those responsibilities, and tested its answers before it needs them, will be able to act within the time it has, whatever the next month is called.