Is this the new cyber normal?

A rapid cascade of severe software vulnerabilities in October 2026 exposed how modern security incidents are amplified by large language models and poor disclosure practices. High-profile cases include PHP2Shell (CVE-2026-109618/109619), discovered by Calif and Wiz using LLMs and estimated to affect ~70% of the web, where an embargo leak and premature fixes led to immediate exploitation; eMudhra’s use of trivially weak intermediate CA keys, prompting major browsers to block its certificates and the company’s exit from the CA business; Railway’s platform compromise that exposed decrypted environment variables and appears aimed at AI inference providers; and multiple GitLab RCEs (CVE-2026-97229, CVE-2026-110264 and earlier CVE-2026-85706) involving regex and path-traversal flaws rated CVSS 10.0. Other contemporaneous bugs (musl libc, LiteLLM, PingCAP, and misposted Linux vulnerabilities) contributed to the sense of crisis.

The central finding is that LLMs have compressed the timeline from vulnerability disclosure to working exploit from weeks or months down to hours or minutes: models can turn vague theoretical issues or patch diffs into automated, repeatable exploits, producing lots of non-working “slop” but also a handful of effective attacks. Combined with leaks, premature disclosures, and coordination failures, this forces a rethink of embargo handling, patching speed, disclosure discipline, and defensive priorities - especially for services tied to AI inference and widely deployed platforms. Bug bounties and coordinated disclosure still matter, but operational practices must adapt to an adversary that leverages automation at scale.