The big items in that post check out, and they're recent. The rest I could not confirm, so I'd treat it as a list of claims, not a settled picture.
Confirmed in reporting from October 21-22, 2026:
- PHP2Shell: two critical PHP remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2. PHP shipped emergency fixes on October 21, after details leaked a day early. Exploitation attempts began before or within hours of the patches, and some Australian government sites went offline as a precaution. The flaws were found with AI help. (The Hacker News and the OpenVPN blog's weekly summary cover this.)
- LiteLLM: version 1.107.0 was published to PyPI and Docker with a credential stealer and a backdoor. It was pulled within hours. Wiz reported stolen AWS credentials in use about four and a half hours after the data was taken.
- CrowdStrike: its October 21 report describes four previously unreported threat actors using AI agents in real intrusions. One Argentina-focused operator compromised at least 15 healthcare organizations, which is a fact the post leaves out. Some of the reported intrusions took about 20 minutes to reach domain-controller credentials.
- GitLab and Node.js: both have urgent patches, including a maximum-severity GitLab flaw.
Not confirmed by what I could find: the Microsoft 'under 3 hours' figure, the bank AI-agent incidents, the John Deere, SharkNinja and Cummins site compromises, Railway, Zeabur and eMudhra in detail, and the OpenAI monitoring incident (CyberHub mentions it, without the detail).
On the bigger point: the trend is real. Attack speed is shrinking from days to hours, and AI is now both finding flaws and being used to exploit them. Whether this week is 'catastrophic' is a judgment, and it depends on how many of the unconfirmed items hold up.
🕒 As of October 2026
