AI agents and $50 attacks: how hacking economics are changing

AI agents are making intrusion cheaper faster than many operators ship patches. Not long ago, a critical bug in PHP itself or a clean virtual-machine escape felt like a once-a-year headline. In October 2026 the feed looked different: the web runtime that powers a huge share of sites got emergency patches, a certificate authority story forced trust-store drama, and routine “just update the CLI” downloads turned into credential stealers.

The sharper shift is not only the CVE list — it is attack pricing. Reuters (19 October 2026) covered a campaign where the operator barely sat on the keyboard: AI agents spent hours probing targets on their own. A NorForge researcher put the token burn at roughly $50 per successful break-in across more than a thousand attempts. Below is what that wave means for someone who runs a VPS, WordPress, GitLab, or a small self-hosted stack — and how to tell a published flaw from a breach that already happened.

AI agents: money first, CVE second

The old model — one skilled human grinding a high-value site for weeks — is still real. Next to it sits another model: a short brief to an agent + an automated pass over a target list. In the activity Reuters reconstructed, a Chinese-speaking operator pushed agents at e-commerce sites in the US, Canada, Australia, and Japan from late September. Attempts topped 1,200; successful site compromises passed 100. A typical win took about a day of autonomous poking. A mix of models such as DeepSeek and Claude Code burned on the order of $5,000 in tokens for the whole run — hence the rough ~$50-per-success figure.

Caveat from the reporting: Reuters could not always tell how much data left each victim. Some companies described a support microsite or a vendor property, not a full enterprise crown jewel. Cheap attacks are not automatic doom for every WordPress install — but the cost of spraying the long tail clearly dropped.

Defense feels the same pressure from the other side. “Good enough” used to mean closing the obvious holes and not looking like the juiciest target. Automation is happy to grind boring sites too. What wins is faster patching, less exposed PHP and admin panels, and a habit of rotating secrets after any supply-chain scare — not a prettier WAF landing page.

October’s mess: four different classes of news

Timelines mashed everything into “the internet is being hacked.” For action tonight, sort by class.

1. Runtime hole: PHP2Shell

PHP2Shell is the informal name for CVE-2026-109618 and CVE-2026-109619 (PHP rates them around 9.2 on CVSS v4). This is not “a bad WordPress plugin.” It sits in the PHP engine while serving web requests — mod_php, PHP-FPM, cgi, and similar. Fixed builds include lines such as 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (confirm against the PHP advisory and trackers like NCSC-NL/php2shell).

Talk of “tens of millions of installs at risk” is about the size of the PHP footprint on the public web, not a confirmed body count of already owned sites. Practical takeaway: upgrade PHP on every web server and container image, not only “WordPress core is current.” EOL 8.1 and older need distro backports or a faster migration plan.

2. Maximum score on self-managed GitLab

GitLab shipped a fix for CVE-2026-110264 at CVSS 3.1 = 10.0: an integer overflow in the regex compiler that, under the described conditions, allows unauthenticated RCE on self-managed instances. Patch to the advisory’s branch releases (for example 19.5.1 and siblings); GitLab.com is on the vendor’s side. Updating a Runner alone does not patch the GitLab application.

A homelab GitLab left on the open internet “for convenience” is exactly the kind of predictable, high-value surface agents like: source code, CI secrets, often a thin perimeter.

3. Hypervisor: PwnEscape

PwnEscape (public write-ups describe a critical guest-to-host path around KVM/networking) is a different story: not “someone defaced my blog,” but “a guest may reach the host.” A home Proxmox box with trusted VMs is not the same risk as a multi-tenant cloud running foreign sandboxes. Watch host kernels, be careful with virtio offload where guests are semi-trusted, and do not confuse “guest updated” with “hypervisor updated.”

4. Trust and supply chain

• eMudhra / emSign — intermediate CA keys generated with absurdly weak randomness. Browser root programs moved fast. If your cert chain touched the affected intermediates, follow distrust/reissue guidance.
• LiteLLM 1.107.0 — not a normal CVE day: a poisoned release on PyPI/containers with a secret stealer. Fixing it is isolation, a clean rebuild, and rotating everything the process could reach — not “pip install -U” inside the infected venv.
• OVHcloud CLI — GitHub Release binaries swapped for ~90 minutes on 19 October (v0.11–0.15 in the download window). OVH says source and CI were untouched; mutable releases were the footgun. Anyone who fetched in-window should clean the machine and rotate secrets; ≥0.16.0 is the clean line.
• Zeabur and similar platform stories — env/secret and account exposure. Rotating a dashboard variable does not change database passwords or third-party API keys. Railway / OpenCode items often still say “alleged / unconfirmed” in secondary posts — wait for a primary source before treating them as fact.

Mass campaigns against corporate Microsoft clouds and other APT write-ups with “AI” in the headline are useful background. Tonight’s checklist still maps to your stack: PHP, panels, Git, CLIs, .env files.

Why it feels like patching cannot keep up

Disclosure velocity rose with better tooling (including LLM-assisted research). Upstream PHP, GitLab, and kernel teams often ship in hours or days, not months. The bottleneck is the long tail: hosters stuck on PHP 8.1 “because it works,” a forgotten GitLab LXC, a year-old WordPress image, CI that pulls latest, and the habit of installing a GitHub CLI binary without checking a hash.

AI hits twice: it helps find bug classes faster and makes it cheaper to work known or half-known surfaces (stale software, open panels, leaked keys). Broader discussions — including Anthropic’s warnings about more autonomous agent risk — are the horizon. October’s practice is plainer: someone else’s agents + your overdue updates.

What to do on your own stack (without burning out)

Layer	Action
PHP / site	Move to PHP2Shell fixed releases; rebuild FPM containers; do not leave ancient mod_php exposed for no reason
VPS	Updates, SSH keys, firewall, fail2ban — the basics in our VPS security checklist
GitLab self-managed	Patch to a release that includes CVE-2026-110264; avoid needless public exposure
Secrets	After any supply-chain hit (LiteLLM, CLI, PaaS), rotate tokens — deleting the package is not enough
Releases / pip / npm	Pin versions, verify hashes/signatures, do not blind-upgrade on chaotic advisory days
Backup	Off-site copy you have actually restored once (same rule as in our VPS backup guide)
Watching	Even simple uptime checks beat discovering an outage from a customer tweet

WordPress and “tens of millions at risk”

If the site runs on PHP, priority one is the runtime and the host image — not a magic plugin that “blocks PHP2Shell.” Themes and plugins still need updates; they will not patch the interpreter. On shared hosting, ask when the panel shipped packages; on a VPS, that is on you.

Self-hosting next to “code cloud” tooling

The more GitLab, build agents, cloud CLIs, and Python model gateways you run, the higher the blast radius of one poisoned update. Keep secrets off convenience env stores on third-party platforms when you can, and do not mix a production laptop with a trendy pip install from a README.

How to read these digests without panicking

• Separate a vulnerability (you need a patch) from an incident (secrets already leaked / a binary was swapped).
• Prefer primary sources: PHP.net, a GitHub Security Advisory, a vendor post — not only a Telegram carousel.
• “Millions at risk” measures attack surface; your risk is version + exposure.
• AI-agent stories are best used as pressure to speed up hygiene, not as a reason to shut everything down and move to the woods.

The dense October timeline that kicked off this piece showed up in digests such as @el_pinguino_channel; the claims above were checked against Reuters reporting and public PHP/GitLab/OVH/supply-chain advisories, rewritten for operators rather than copied as a bullet dump.

Bottom line

The internet did not “break in two weeks.” What broke is the habit of treating critical RCE as a rare holiday and intrusion as expensive craft labor. AI agents make recon and exploitation cheaper; October 2026 also hit PHP, self-managed GitLab, trust chains, and the reflex to trust “whatever GitHub Releases just served.”

The practical answer is familiar, only stricter on deadlines: patch the runtime, shrink the surface, rotate secrets after supply-chain events, keep a backup. Fifty dollars of tokens for someone else’s successful run is a bad reason to assume your stack on last year’s autopilot is fine.