Black October Was Accelerated by AI. Here's What Comes Next for CVE Monitoring.

The last ten days have been nicknamed "Black October" in the security press. Two critical PHP RCE vulnerabilities on October 21 ("PHP2Shell"). A critical Node.js RCE in the Brotli decoder on October 23 ("Node2Shell"). Palo Alto Networks disclosing that every supported version of PAN-OS and Panorama was vulnerable, with no fix available for days. Cisco auditing 18 products and 13 cloud services for exposure. Fortinet reviewing eleven products. NSA, NCSC and CERT-EU telling operators to take unpatched systems offline. Cloudflare reporting exploit attempts climbing from thousands to millions within hours.

What makes Black October different from any previous bad patch cycle is who found the vulnerabilities. The PHP2Shell flaws were discovered by an AI model. The Node.js RCE was adjacent to the ongoing Project Glasswing wave. Microsoft's October Patch Tuesday shipped 1,408 CVEs in a single day, more than it disclosed in all of 2025. The pattern isn't a bad month. It's the first clear sign of a structural shift that's been building for 18 months.

The question for anyone running production infrastructure isn't "how bad was this week". It's "what does the next twelve months look like, and what should my CVE monitoring workflow look like to survive it".

What AI changed in vulnerability discovery

The baseline numbers are already striking. Project Glasswing, Anthropic's coalition of twelve organizations testing Claude Mythos Preview on open-source projects, reported more than 10,000 high- or critical-severity vulnerabilities surfaced in its first month alone. The model scored 83.1% on the CyberGym vulnerability reproduction benchmark. Specific findings include a 27-year-old OpenBSD vulnerability and a 16-year-old FFmpeg bug, both of which had survived decades of human review and automated static analysis.

Cloudflare's own participation surfaced about 2,000 bugs in its critical-path systems, 400 of them high or critical. The DARPA AI Cyber Challenge, which concluded at DEF CON 33 in August 2025, analyzed over 54 million lines of code across 53 projects, reproduced 63 challenge vulnerabilities, and found 25 previously unknown flaws at an average cost of about $152 per task.

The structural implication isn't that AI "finds more bugs". That's been true of fuzzing and static analysis for years. The implication is that AI finds bugs faster than the ecosystem can process them. By May 22, 2026, Anthropic had disclosed 1,596 vetted findings to maintainers of 281 open-source projects. 97 were patched. That's roughly 6% within six weeks, and the gap is widening every quarter.

Some open-source maintainers reportedly asked Anthropic to slow its disclosure rate. Not because the findings were wrong, but because they couldn't keep up.

What AI changed in exploitation

Discovery is only half the picture. The other half is how fast attackers weaponize what's found.

Mandiant's M-Trends 2026 report found that 28.3% of CVEs are now exploited within 24 hours of disclosure. Time-to-exploit has fallen from 63 days (median in 2018) to about 5 days (median in 2026). CrowdStrike's 2026 Global Threat Report measured a 42% year-over-year increase in zero-day vulnerabilities exploited before public disclosure in 2025.

Reuters reported one operator who used AI agents to breach more than 100 companies for about $5,000 in tokens, roughly $50 per successful breach. Not $50 per attempt. $50 per confirmed intrusion.

PHP2Shell fits this exact pattern. Amazon's CISO reported seeing probing four days before any patch existed. By the time the PHP Group shipped the fix at 14:00 UTC on October 21, public exploit code was already circulating, and Cloudflare saw real attack traffic within hours. The window between "vulnerability exists in the wild" and "mass exploitation at scale" is now measured in hours, not weeks.

Why the current CVE workflow is breaking

The CVE monitoring workflows most teams built between 2015 and 2022 assumed three things that are no longer true:

1. NVD enrichment would always be timely. CVE submissions grew 263% from 2020 to 2025. In April 2026, NIST announced it would limit enrichment to the highest-risk submissions. Unenriched CVEs published before March 1, 2026 were formally reclassified as "Not Scheduled". If your scanner, SIEM, or compliance tooling depends on NVD CVSS scores to prioritize work, a growing fraction of CVEs now have no score at all.

2. Maintainers would patch within a reasonable window. The 90-day disclosure window pioneered by Google Project Zero was calibrated for a world where maintainers received handful of serious reports per year. Project Glasswing alone disclosed 1,596 findings to 281 projects in six weeks. Many open-source maintainers are solo volunteers. The math doesn't work.

3. Humans could triage new disclosures. HackerOne paused new submissions to its Internet Bug Bounty program on March 27, 2026 because the valid submission rate had fallen from about 15% to below 5%. The signal-to-noise ratio of human-filed vulnerability reports has collapsed under AI-generated submission volume.

Each of these three assumptions supported the standard workflow: scanner finds vulnerability, scanner cross-references NVD for severity, team patches based on CVSS score, maintainer ships fix within 90 days. Every link in that chain is now partially broken.

What this means for your ops

The response for anyone running production infrastructure isn't "patch faster". That treadmill is impossible to win when AI generates CVEs faster than humans can read them. The response is to restructure your workflow around the assumption that discovery will keep accelerating. Three concrete practices to adopt now:

1. Shift from CVE-based to exploitation-based prioritization

CVSS score was a reasonable proxy for "should I care about this" when CVE volume was manageable. In the current landscape, CVSS alone will drown you in critical-rated findings that aren't being exploited while missing medium-rated findings that are.

Replace or supplement CVSS-driven prioritization with two signals that scale better:

• CISA KEV catalog: the authoritative list of CVEs with confirmed in-the-wild exploitation. Mentioned by name in our 5 signs you don't have a real security watch article three weeks ago as the single most important CVE feed. Black October validates that recommendation.
• EPSS (Exploit Prediction Scoring System): probability-based score estimating likelihood of exploitation in the next 30 days. Free, updated daily, independent of NVD enrichment. Combine with KEV for a complete picture.

The rule of thumb: patch KEV entries affecting your stack today, patch EPSS >70% within the week, treat CVSS alone as a secondary signal.

2. Invest in inventory, not just patching

The CIO Magazine coverage of Black October made this point explicitly: patching is no longer the bottleneck. Knowing where to patch is. When PHP2Shell dropped, the fastest-responding teams weren't the ones with the best patch automation. They were the ones who could answer "which servers in our fleet run PHP, which versions, and are any of them internet-exposed" in under five minutes.

If your team can't answer that question in minutes for every major language runtime (PHP, Node.js, Python, Ruby, Java), network device vendor (Cisco, Fortinet, Palo Alto, SonicWall), and self-hosted application you run, your weakness is inventory, not patching speed. Our post-provisioning checklist covers the minimum viable inventory discipline for small teams.

For medium teams, tooling like osquery, Steampipe, or NetBox makes the inventory queryable instead of document-based. The specific tool matters less than having the data current and queryable at the moment it matters.

3. Add compensating controls that don't depend on patch status

The 5-day median time-to-exploit means you'll sometimes be vulnerable between disclosure and your patch deployment, no matter how fast your ops team is. Compensating controls that reduce blast radius during that window are no longer nice-to-have:

• Network segmentation: internet-exposed services should not have direct access to internal databases, management interfaces, or lateral movement paths
• Runtime behavioral monitoring: anomalous process spawns, unexpected network connections, privilege escalations should fire alerts regardless of what CVE triggered them
• WAF rules for high-value apps: Cloudflare, Fastly, and others deployed PHP2Shell protections at the edge before most teams had patched. Edge-level pattern matching bought real time
• Backup and restore readiness: if exploitation leads to data destruction, your recovery is backup-dependent. Our complete backup strategy covers the baseline

None of these three practices are revolutionary individually. The shift is treating them as the primary infrastructure instead of CVE patching as the primary infrastructure.

The uncomfortable truth about the next 12 months

If Project Glasswing's trajectory continues, and there's no reason to think it won't, 2027 will see hundreds of thousands of AI-discovered vulnerabilities disclosed. Many will be in the long-tail dependencies your applications don't audit (deeply nested npm packages, PHP Composer dependencies, Python wheels pulled by other libraries). Many will affect code that hasn't been meaningfully maintained for years.

The teams that will handle this well have three things:

• Automated security updates on everything that doesn't require manual approval (unattended-upgrades, Dependabot, Renovate, equivalent tooling)
• A current, queryable inventory of what runs where, in what version, exposed how
• Compensating controls that reduce blast radius during the hours or days between disclosure and your patch

The teams that won't are the ones still running the 2019 playbook: wait for NVD to enrich CVEs, read CVSS scores, patch "critical" findings "soon", hope exploitation lags disclosure. That playbook is being retired in real-time, and Black October was the loudest signal yet.

For teams running production workloads on Dedimax VPS or dedicated servers, the shift above is manageable with a few hours of workflow redesign and ongoing discipline. The time to make that shift is before the next Black October, not during it. On the current trajectory, the next one is a few weeks away at most.

Sources: Project Glasswing research note (Cloud Security Alliance), Black October analysis (CIO Magazine), Mandiant M-Trends 2026, CrowdStrike 2026 Global Threat Report, Anthropic Expands Claude Access for Vetted Cyber Teams (The Hacker News).