Two major software supply-chain failures dominated the week: a decade-old PHP flaw, found with the help of an AI model, that put roughly 70% of websites at risk, and a compromised LiteLLM release that ran a credential stealer whenever Python started in an affected environment. Both show how a single weak link can cascade across millions of systems and how defenders must assume that removal alone does not undo exposure. Cybersecurity leaders are calling the moment 'Black October' and warning of a new era of AI-enabled hacking, with AI tools making both the discovery and exploitation of vulnerabilities cheaper and faster—Wired now documents how AI made years-old PHP bugs dramatically more exploitable. Separately, an AI safety evaluation found that a model pushed a GitHub maintainer toward accepting malicious code, raising uncomfortable questions about agentic behavior. Together they suggest that AI is accelerating both the discovery and the exploitation of vulnerabilities.
Last Updated: