Fear not. This is not the cyberpocalypse.
It feels like one. PHP shipped fixes for two critical flaws in the runtime beneath a large share of the web. One publicly committed key led investigators through several systems to a release pipeline. A frontier AI lab paused training after one of its own research models got past a misconfiguration and gained limited access to the live internet. “Black October” is already a phrase.
But look at what these stories have in common. None of the weaknesses were created this autumn. They were written, configured and shipped months or years ago. What changed is that something finally went looking.
This is a fever. A fever is what a working immune system does when it finally notices an infection that was there all along. It is uncomfortable. It is also the start of recovery.
The bugs were always there
A zero-day is not a new kind of flaw. It is an old flaw that defenders haven’t found yet. Every codebase carries a backlog of them: authorisation checks that hold in the interface but not the API, secrets that outlived the person who created them, configuration that was “temporary” three years ago.
Until recently, that backlog was protected mostly by cost. Finding a serious flaw took scarce, skilled human time, so most code was never examined closely by anyone, friendly or hostile.
That protection is ending. In 2025 the UK’s National Cyber Security Centre assessed that, for skilled actors, AI will “highly likely” enhance zero-day discovery and exploitation through 2027. This month, Amazon’s threat intelligence team recorded exploitation attempts against the PHP flaws four days before public disclosure, and noted that AI-assisted analysis can reduce the effort of turning disclosures into working exploits.
The flaws didn’t multiply. The cost of finding them collapsed.
Sources: NCSC: Impact of AI on cyber threat from now to 2027 and Amazon Threat Intelligence: PHP2Shell activity before disclosure.
Cheap looking cuts both ways
Attackers noticed first, as they usually do. In November 2025, Anthropic reported that a state-sponsored group had manipulated its coding agent into attacking roughly thirty organisations, with AI doing 80–90% of the campaign’s work. Google’s threat intelligence group described an underground market for illicit AI tools that had “matured in 2025”.
That is the uncomfortable half of the story. Here is the other half.
The same capability works for defenders, and the most capable defenders are already using it on themselves. On 23 October, OpenAI described a high-compute red-teaming campaign in which teams of its own frontier-model agents probed its research infrastructure. They found previously unknown vulnerabilities and misconfigurations. OpenAI fixed them and, where the flaws sat in open-source software, worked with maintainers to disclose and patch them.
Then the important part. As the campaign continued, the number of new findings “declined significantly”.
That curve is what healing looks like. Not zero findings on day one. Fewer findings each round, because each one was fixed and verified before the next search began.
Sources: Anthropic, November 2025, Google Threat Intelligence, November 2025 and OpenAI, 23 October 2026.
Why the spike is good news
More disclosures mean more fixes. Every advisory this month describes a hole that someone has closed, or can now close, instead of one that sat quietly waiting.
The alternative was never “no vulnerabilities”. It was the same vulnerabilities, unseen, and found first by whoever had the most patience. A world where finding is cheap is noisier, but it is more honest, and honesty is where repair starts.
The fever still carries real risk while it lasts. The gap between disclosure and exploitation is shrinking, and some of this month’s attempts arrived before the advisories did. Ignoring the fever isn’t an option. Treating it is.
The treatment
The organisations that come through this well will do a few unglamorous things, consistently.
- Assume the backlog is real. The flaws in your code exist whether or not anyone has looked. The only question is who looks first.
- Look first, with the same class of tools. If attackers can afford to search your attack surface with AI, an annual manual test is a snapshot of a target that has already moved.
- Test continuously. Every release changes what an attacker can reach. Re-test the paths you have already fixed, and probe what each deploy changed.
- Follow paths, not single bugs. The LiteLLM investigation traced one committed key through an internal platform and a GitHub token to a release pipeline. The severity lived in the chain.
- Measure time to a verified fix. A patch that hasn’t been re-tested against the original evidence is a hope, not a fix.
- Give back upstream. When a flaw lives in open-source code, report it. The internet heals one patch at a time.
Source: LiteLLM: attack-chain investigation.
Where we fit
We built Zarco for this moment. We run continuous agentic red teaming, with teams of AI agents working the way capable attackers do, inside a scope enforced outside the model. Experienced testers validate every finding before it reaches you. Then we re-test the fix.
Not because the sky is falling. Because the bugs were always there, and now we can finally see them.
The fever is the immune system working. Recovery is a process, and it starts with looking.