On October 22, 2026, within 24 hours of the PHP bug disclosure, a large number of Node.js flaws were disclosed alongside other breaches, a cluster security leaders call Black October. Microsoft has since said threat actors used the Chinese open-source AI tool Artex to attack hundreds of companies. The discussion is about whether the cluster marks the start of a new normal of AI-accelerated vulnerability discovery and attack tempo, and what role AI tooling played in the Artex campaign.