PHP, eMudhra, LightLLM: Inside October's AI-Driven Security Breaches
PHP vulnerabilities, weak eMudhra keys, and a LightLLM supply-chain hack defined a brutal October. Here's what happened and why AI changed the stakes.
What happened in the October security incidents?
Three separate incidents converged in October to expose how fragile parts of the internet’s infrastructure still are. PHP, the server-side language behind a large share of the web including WordPress sites, shipped fixes on October 21st for two critical vulnerabilities that let attackers run unauthorized code ahead of a website’s own application logic. Separately, researchers found that certificate authority eMudhra had issued private keys so weak that one of them was simply the number four. And LightLLM, a tool used to connect applications to AI models, disclosed that a distributed release had shipped with credential-stealing malware baked in, the second such compromise it had dealt with in a year. None of these problems were caused by AI. But AI agents are now finding, exploiting, and defending against this class of bug faster than the humans who built the systems ever could.
TL;DR
- PHP’s critical vulnerabilities, patched October 21st, allowed attackers to execute code on affected servers before a website’s own application even started running, prompting UK and European security agencies to recommend isolating or shutting down systems that couldn’t be patched quickly.
- eMudhra, a trusted certificate issuer, was found using private keys so weak that security researcher Scott Helme recovered eight of them in under a second, with one key turning out to be the number four, and he reportedly got Claude to help recover the keys with a single prompt.
- LightLLM suffered its second compromise in a year, with its October disclosure revealing that while the source code repository looked clean, the actual distributed release contained credential-stealing malware, meaning teams had to treat their environments as compromised and rotate secrets rather than trust a clean-looking repo.
- Major infrastructure providers moved fast to contain the fallout, with Mozilla pushing protections to Firefox within hours of the PHP report and Cloudflare and Vercel shielding sites sitting behind their networks even before individual site owners patched.
- Microsoft documented a China-aligned group using an AI agent framework to target hundreds of organizations, with some attacks reaching privileged cloud access within hours, showing that AI-driven offense is already operating at meaningful scale.
- API keys for AI tools like Claude and Codex are now valuable theft targets, because a stolen key lets an attacker run AI workloads on someone else’s account and bill, a risk that didn’t really exist before AI usage became metered and routine.
- The maintenance backlog behind these bugs is old, with PHP’s own maintainers reportedly aware of one issue since 2024, underscoring that AI isn’t creating new weaknesses so much as exposing ones that sat unpatched for lack of time and resources.
Why did PHP’s vulnerabilities matter so much?
PHP runs a significant portion of the web, including most WordPress installations, so a flaw in it has an unusually wide blast radius. The specific issue involved how PHP executes in certain server configurations, such as Apache’s mod_php setup: attackers found a way to get their own code to run before a website’s legitimate application code even started. That’s effectively a hijack of the web server itself, not just the application sitting on top of it.
The response from government cybersecurity agencies in the UK and Europe was blunt. Organizations that couldn’t patch or apply mitigations quickly were told to consider isolating or taking affected systems offline entirely. That’s a rare level of urgency, equivalent to telling businesses to interrupt operations because the software underneath them is unsafe for the public. Infrastructure providers responded in parallel. Cloudflare and Vercel, which sit in front of large numbers of websites, pushed out protections that shielded sites behind them even before those site owners updated PHP themselves. Mozilla says it distributed protections to standard Firefox configurations within a couple of hours of receiving the report.
How did a certificate authority end up using “4” as a secret key?
eMudhra issues digital certificates, the credentials that let your browser confirm you’re connecting to the website you think you are. Those certificates depend on private keys that are supposed to be effectively unguessable, long random numbers that would take enormous computing power to brute-force.
Instead, researcher Scott Helme found that eMudhra had implemented key generation in a way that made the keys trivially recoverable. He pulled eight of them in under a second. One of the keys, meant to anchor trust for a chain of certificates, was literally the number four. Because eMudhra operated as a root certificate issuer, its certificates were automatically trusted across the internet’s trust infrastructure. A failure at that single point cascades outward to every system that trusted certificates it issued. Helme reportedly used Claude with a single prompt to help recover the weak keys, which is the detail that makes this story relevant beyond cryptography circles: finding this kind of flaw no longer requires a team of specialists and weeks of effort.
What went wrong with LightLLM?
LightLLM is infrastructure, a tool that routes requests from applications to AI models and often holds the API keys needed to talk to those model providers. In October, its maintainers disclosed that a release had shipped containing credential-stealing malware, the second compromise LightLLM had experienced within a year (the first was in March).
Other agents ship a demo. Remy ships an app.
Real backend. Real database. Real auth. Real plumbing. Remy has it all.
The complicating detail is that the official source code tag looked clean. The malicious code existed only in the distributed release package, the thing that actually gets installed on people’s machines. That means checking the GitHub repository and seeing nothing wrong tells you very little. Teams that run LightLLM as part of an AI gateway, sitting between a customer-facing application and the model providers it calls, had to treat their entire environment as potentially compromised, follow containment steps, and rotate every secret the gateway had access to, regardless of whether the visible source code looked fine.
Why are AI API keys suddenly worth stealing?
API keys for services like Claude or Codex grant metered, billable access to AI compute. If someone steals your key, they can run AI workloads on your account and send you the invoice, or resell that access to someone else entirely. Tokens, in other words, now behave like a form of currency. This is a new category of theft that didn’t meaningfully exist before AI usage became both ubiquitous and metered, and it’s part of why AI keys deserve the same treatment as passwords or payment credentials: stored carefully, scoped narrowly, and rotated when a connected tool gets compromised.
Is AI making cybersecurity worse or better?
Both, and that’s the actual story. The same core loop, reading unfamiliar code, spotting something suspicious, writing a test, running it, revising a wrong theory, and trying again, works identically whether the agent running it is attacking a system or defending one. Microsoft has documented a China-aligned group using an AI agent framework to target hundreds of organizations, with some attacks reaching privileged cloud access within hours. Most of those attempts reportedly failed, but the ones that succeeded moved at a pace no human attacker team could match without far larger headcount.
On the defensive side, the same speed applies. Anthropic has reported identifying more than 29,000 candidate vulnerabilities from six months of scanning widely used software projects, with roughly 6,000 manually reviewed and triaged so far. That’s a volume of bug-hunting no human team could sustain, and it suggests a very large population of undiscovered or unpatched weaknesses still sitting in software people rely on daily.
The uncomfortable twist is that safety guardrails built into AI models to prevent offensive misuse sometimes slow down defenders too, forcing security teams to switch models mid-emergency. The practical lesson for anyone running defense is straightforward: don’t assume a weaker, more restricted model keeps you safer. The attackers are not using a weakened model, so defenders need access to the strongest one available.
What should individuals and teams actually do this week?
For individuals, the most useful step is auditing connected app permissions on major accounts, Google being a common example, and revoking access you no longer need or recognize. Reducing the number of apps that can reach your files, calendar, or email shrinks your exposure regardless of which specific breach happens next. An AI assistant can help with this: feeding it the list of connected apps and their stated permissions, then asking it to flag anything excessive or unused, turns a tedious manual audit into a fast check.
For teams running infrastructure, the LightLLM case is the template to remember: a clean-looking source repository does not guarantee a clean distributed package. When a disclosure lands, the responsible move is to treat the environment as compromised until proven otherwise, follow the vendor’s containment steps, and rotate every credential the affected tool had access to. Waiting for certainty before acting is how small compromises turn into large ones.
Built like a system. Not vibe-coded.
Remy manages the project — every layer architected, not stitched together at the last second.
Frequently Asked Questions
What is Blocktober?
It’s the informal name some cyber defenders gave October’s cluster of major security incidents, including the PHP vulnerabilities, the eMudhra weak key disclosure, and the LightLLM supply-chain compromise, all surfacing in a compressed window.
Was PHP itself hacked, or was this a vulnerability disclosure?
It was a vulnerability disclosure and patch, not a single hack. PHP’s maintainers released fixes for two critical vulnerabilities on October 21st after researchers identified ways attackers could execute unauthorized code on servers running certain PHP configurations.
How did eMudhra’s weak keys affect ordinary internet users?
Because eMudhra operated as a trusted root certificate issuer, weak keys at that level could theoretically let an attacker forge certificates that browsers and systems would automatically trust, undermining the basic mechanism that confirms you’re connecting to a genuine website.
What should I do if I used LightLLM during the affected release window?
Follow the vendor’s containment guidance, assume credentials handled by the gateway were exposed, and rotate all associated API keys and secrets rather than relying on the fact that the source repository appeared unaffected.
Why does a stolen Claude or Codex API key matter financially?
Because usage of those services is billed by consumption, a stolen key lets someone run AI workloads on your account and leaves you responsible for the resulting charges, in addition to any data or access they obtain through that key.
