On October 21, PHP shipped emergency patches for two flaws that let anyone on the internet run code on a server with a single crafted request. They reached back through every version from 5.4 to 8.5. If you have ever run a WordPress site, you were probably exposed.

The security world has started calling this month Black October. PHP2Shell was the headline, but it landed alongside a poisoned LiteLLM release on PyPI, a remote code execution fix for GitLab, and an out-of-bounds write in Google's Brotli decoder that reaches into Node.js and Firefox. What struck me was the advice that came with it. The NSA told organizations that couldn't update right away to take their sites offline. Not monitor them, not add a firewall rule. Turn them off.

Governments did exactly that. The Dutch government portal went dark. Finland pulled all of its public-facing government web services. France took down every website of its Interior Ministry, and Canada took some of its sites down too. Amazon spotted the first attempt to exploit it four days before the fix was even public.

I can't remember a time when the official guidance for a large part of the web was to unplug it.

The detail that stayed with me is how PHP2Shell was found. A researcher at a firm called Calif found one of the flaws in August using OpenAI's GPT-5.6 Sol, as part of an OpenAI project to audit open source code. Researchers at Wiz found them independently with Gemini 4 Argon and GPT-5.6 Sol, then showed working attacks against WordPress, Drupal and Joomla.

That same day, my home internet went down.

It was a strange feeling. I had servers to patch and no Fios. For a few hours I honestly didn't know whether the two things were connected.

They weren't. It turned out to be a problem with the box outside the house, and a tech came out the next day and fixed it. But I didn't know that yet. So I set up my Starlink and kept working over satellite.

There I was, patching servers on backup internet, trying to keep a few things standing while something I couldn't see probed every PHP endpoint it could reach. It gave me a small glimpse of what a more chaotic world might feel like. Not the movie version. Just an ordinary day where the things you rely on stop being reliable at the same time, and you don't know why.

The thing is, it didn't feel completely new. It felt like a louder version of something I already live with.

I now get dozens of calls and texts a day that I have to filter. That's before the spam and the phishing emails. Most of it is someone trying to get something out of me, and some of it is getting good enough that I have to look twice.

I've mostly stopped answering unknown numbers. A phone line used to be how someone reached you. For anyone you don't already know, it has become close to useless.

There is a constant background noise of scammers and spammers that all of us navigate every day. And we just live like this is ok.

It isn't ok. We are the frog in the pot, and the water has been warming slowly enough that nobody stopped to object. Each year the filters get a little better and the noise gets a little worse, and we adjust. After enough adjusting, it starts to feel normal.

Sitting there on the Starlink, I had a darker thought. Maybe the battle with the machines has already begun, and it just doesn't look the way we imagined.

There are no robots in the street. There is an invisible army of unknown origin. Some of it is people. A growing share of it is automated: scanners that sweep the internet within hours of a disclosure, bots that send texts by the million, and now models that can read a codebase and find the hole before the people who wrote it do.

I don't know who sends most of the calls I get. I don't know who was hitting my servers that week. I just know it never stops.

The uncomfortable part of Black October is that the same capability cuts both ways. AI helped find PHP2Shell and get it patched. The same kind of model, in other hands, could find the next one and keep quiet about it. Offense and defense now run on the same tools, and both sides keep getting faster.

That led me somewhere I didn't expect. Everyone keeps asking where the new jobs will come from once AI takes over a lot of the work we do now. Maybe part of the answer is right here. Maybe a big share of the new work is defensive.

Someone has to patch the servers. Someone has to decide which alert is real, which login is a person and which message to trust. Someone has to come fix the box outside the house. As more of the attack gets automated, holding the line might be some of the most human work left. It takes judgment, responsibility and showing up again the next morning.

It's a dark way to find purpose. But it is purpose. In a world full of machines probing for weaknesses, people are still the ones deciding what is worth protecting.

I don't know if that's where this goes. Maybe the defenses get automated too, and it becomes machines against machines while we watch. What I do know is that my day of patching and rerouting didn't feel like the future. It felt like the present, just a little closer to the surface.

The question I keep coming back to is how long we keep calling this normal.