What Is Blocktober? AI Agents and the October Attack Wave

What is Blocktober?

Blocktober is the name some cyber defenders gave to a cluster of serious security incidents in October. It covers critical PHP vulnerabilities, a certificate issuer with absurdly weak private keys, a poisoned release of an AI gateway tool, and a China state-aligned group using an AI agent framework against hundreds of organizations. The common thread is speed. AI agents can read code, test ideas and find flaws far faster than people, and both attackers and defenders now have access to them.

What happened with PHP?

On October 21st, PHP released fixes for two critical vulnerabilities. PHP runs a huge share of the web, including WordPress sites. In the setup described, using Apache's mod_php, an attacker could get code to run before a site's own application code even starts. That lets them hijack the platform underneath the site.

The response was unusually blunt. UK and European security agencies told organizations to consider isolating or taking down affected systems that could not be updated or mitigated quickly. Governments rarely tell businesses to interrupt operations. That tells you how seriously they rated it.

Large infrastructure providers moved fast to shield sites that had not patched. Mozilla said it distributed protection to standard Firefox configurations within a couple of hours of receiving the report. Cloudflare put protections in front of sites behind its network, and Vercel joined in. Because these companies sit in front of so many sites, one fix at their layer protects many owners who have not yet updated PHP.

There is also a maintenance story. PHP's maintainers recognized signs of one of the underlying problems back in 2024. The fix carried compatibility risks and needed scarce expert time, and the work stalled and restarted without finishing. A two-year debate over trade-offs is a luxury that agent-speed bug hunting removes.

How did eMudhra's keys get recovered in under a second?

eMudhra issues certificates, the mechanism that helps your browser decide whether it is talking to the right website. Eight of its private keys turned out to be trivially weak. Security researcher Scott Helme recovered them in less than a second.

Private keys should be enormous random numbers, hundreds of digits long. One of these was the number four. The way the keys were put into use meant an ordinary laptop could derive them almost immediately.

This mattered because of trust. eMudhra was a root certificate issuer, so certificates it issued were automatically trusted. One company's mistake could cascade across the internet's chain of trust. Helme reportedly got Claude to recover the keys with a single prompt. The flaw sat in a normal-looking system that passed checks and had been trusted for years, and an agent found it by digging around.

How are AI agents changing the speed of attacks?

The basic loop is simple. An agent reads unfamiliar code, notices something suspicious, writes a test, runs it, finds its first explanation was wrong, and keeps trying. A good human engineer can do the same thing, but humans eat, sleep and don't scale. Agents don't tire, and the cost of running them is tied to computation rather than headcount.

Microsoft documented a China state-aligned group using an agent framework called Artek to target hundreds of organizations. Most of that targeting failed. Some attacks still reached privileged access to cloud systems within a couple of hours. Microsoft also flagged proxy-style attacks, where attackers use credentials customers had previously trusted to hit other surfaces.

The practical lesson for any company: assume you may be the target of a cheap, well-equipped operation, possibly run by one person, rather than only a large and expensive campaign.

How big is the pool of undiscovered bugs?

Large, and now measurable. Anthropic reported more than 29,000 candidate vulnerabilities from six months of scanning important software projects. About 6,000 had been manually reviewed and triaged at the time. The creator whose commentary prompted this piece argued that realistically there could be millions of undiscovered or unpatched weaknesses across the software people use. That is an estimate, not a count.

The bottleneck is shifting from finding bugs to triaging and fixing them. Candidates need human review, and maintainers have limited time.

Why do AI keys and gateways matter so much?

Tokens now work like cash. If someone steals the key you pasted into an app, they can use your Claude or Codex access, run it themselves or sell it, and you get the bill.

LiteLLM, a popular tool for connecting applications to AI models, is the example here. Its October disclosure describes a release that contained credential-stealing malware, and it had already dealt with a compromise in March. Other incidents that week included a hosting company saying it is shutting down after another breach, and a founder taking a product offline after warnings that its AI and payment keys were compromised.

The LiteLLM case has a subtle detail. The official source tag was clean, but the distributed release contained malicious files. Reading the source repository does not tell you what was inside the package your machine installed. If you ran the affected release, treat the environment as compromised, follow the containment instructions and rotate your secrets.

What should you do this week?

For individuals and small teams:

1. Review connected apps on important accounts. In Google, you can see and remove access granted to outside apps.
2. Read what each connection permits, such as basic profile data, reading files or changing them.
3. Keep what you need and cut the rest. Smaller surface area means less exposure.
4. Rotate AI and payment keys if any tool in your chain was affected.
5. Check what you actually installed, not just what the source repo says.

You can also hand your AI assistant a list of app names and permission descriptions and ask it to flag risky access. The same one-line-prompt power that finds flaws can drive a basic audit.

Should defenders use the strongest AI models?

Yes. Offense and defense use almost the same actions: read code, form a hypothesis, test it, adjust. As a result, some safeguards built to block cyber offense also trip up legitimate defenders, who have reportedly had to switch to other models during emergencies.

The argument is that fear of a model misbehaving is not a reason to choose a weaker one for defense. Attackers will use the strongest model they can find. Security teams should confirm now that they have access to the best defensive models, before an incident forces the question. For the policy angle, see what an AI pause would fix for cyber risk.