Cisco Talos Estimates Half of PHP Systems Won't Get an Official Patch as 'Black October' Breach List Grows

Since the PHP Foundation disclosed two critical flaws on Tuesday, Oct. 20, the question has shifted from how fast the patch ships to how many sites will never get it.

Cisco Talos estimates that about 50% of all PHP systems worldwide will not receive an official patch for the two issues, known together as PHP2Shell. The reason is mundane. Aging websites run outdated, unsupported versions of PHP, and there is no easy upgrade path for them.

That is an estimate from one firm, not a count. It still points at the hard part of this story. A patch only protects the sites that install it.

Attackers are adapting

Daniele Molteni, director of project management at Cloudflare, said the company has seen exploit attempts, "including spikes of thousands of attempts." He added: "We also saw attackers modifying their tactics to try to bypass protections."

Cloudflare CEO Matthew Prince described the ramp in a post. In the 10 hours before the public announcement, Cloudflare saw thousands of attempts. That rose to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and "millions now."

The National Security Agency's Cybersecurity Collaboration Center advised sites that could not fix the problem immediately to go offline. PHP Foundation Executive Director Elizabeth Barron said: "These are critical vulnerabilities and anyone using PHP should upgrade as soon as possible."

How long the bugs were known

According to OpenAI, researchers at the security firm Calif first caught the bugs in July with help from one of OpenAI's most advanced models. Wiz independently discovered and reported them in August. OpenAI, Google and Calif completed a patch in early October.

So the fix existed for roughly two weeks before the public disclosure. Calif researcher Bruce Dang said the delay mattered. "Imagine, nobody knew anything when, boom, today dropped. That would be extremely bad," he told USA TODAY. "It could have been a really bad thing."

USA TODAY reports PHP is used in as much as 70% of websites. Running PHP is not the same as being exploitable. A patched site is not affected.

'Black October' bundles very different incidents

A post from the AISafetyMemes account at 03:42 UTC on Oct. 22 called the previous 48 hours the worst in cybersecurity history and gave it the name "Black October." Its numbered list ran from PHP2Shell to the certificate authority eMudhra, California student data, the Railway and Zeabur hosting platforms, LiteLLM, GitLab and others.

The items are real incidents, but they are not one event, and several are old.

• California student data: Attackers copied records from a testing contractor's SFTP site between May 22 and Sept. 18, using a compromised login. The contractor, Educational Testing Service, discovered the breach on Sept. 25 and began notifying families on Oct. 16. The data covers children who attended California public schools over the past three years, including disability status and testing accommodations. The Los Angeles Times reports the number affected is well above the current 5.7 million figure.
• Palo Alto Networks: The flaw CVE-2026-0257 in PAN-OS was patched May 13. Rapid7 reported attacks from May 17. Palo Alto's Unit 42 has seen exploitation attempts by the ransomware groups Qilin and Inc.
• PingCAP: An unauthorized party accessed internal systems of the TiDB vendor between Sept. 9 and Oct. 7 using stolen service-account credentials and took source code.
• Zeabur: The platform's preliminary report says the attacker used internal AWS keys and shared-cluster admin tokens. Those tokens sat in plaintext in a private configuration repository and "were omitted from rotation following the August incident." Exposure is put at 321,810 accounts and more than 3.2 million environment variable records. The founder announced Oct. 17 that Zeabur will shut down, winding down services through December 2026.
• LiteLLM: Seven PyPI wheels of version 1.107.0 were live from 11:39:51 to 13:23 UTC. The payload stole browser, cloud and AI tool credentials and carried a second-stage remote access tool. LiteLLM says three engineers' GitHub accounts were used. It is the project's second compromise in seven months.
• Railway: The company said an unauthorized party "may have accessed encrypted environment variables" and obtained decrypted contents for some. It has not disclosed the entry point.

The pushback on the framing

Security Today's analysis argues the surge was "mainly in disclosures," and that many attacks began weeks or months earlier. A common thread, it says, is stolen credentials, compromised delivery channels and platforms serving large customer bases.

The web firm Raileon says it checked the viral list against company notices and found errors. Tailscale was not breached, it says. Tailscale published a bulletin about the eMudhra certificates, says traffic between devices on a tailnet is not affected, and asks users to update to version 1.104.2 or later. GhostAction, Raileon adds, is not new: it was first reported in September 2025 and returned this autumn.

Raileon also says no source supports the claim that "a third of the internet is broken." In its words, the figure seems to confuse how widely software is used with how many sites were harmed.

The alarm among practitioners is nonetheless real. Johns Hopkins cryptographer Matthew Green wrote that "we're in the part of the movie where you need to throw whatever you can in the path of the zombies and hope it slows them down." He also wrote that the internet is "dry tinder" and that "teenagers haven't found the matches yet." 404 Media's reporter, who has covered security for a decade, wrote that the pace has made it hard to predict where this goes.

What is still open

No one has said how many of the roughly half of PHP installs without an official patch are exposed to the internet and reachable by the attacks Cloudflare is blocking. Zeabur has not established how the attacker first obtained its credentials, or whether one actor was behind both of its breaches. Zeabur's customers are working against a wind-down that runs through December.