Black October: dozens of major cyberattacks and AI-exploited flaws shake the internet

A wave of attacks is hitting the internet

Cybersecurity professionals describe October 2026 as Black October, a month marked by dozens of major cyberattacks and AI-identified software flaws. The period is not over, and the situation is being compared by some experts to an emergency on a very large scale.

A critical security flaw in PHP, the programming language that powers around 70% of websites, was discovered using AI tools and disclosed by the PHP Foundation on Oct. 21. After the disclosure, Cloudflare reported thousands of exploit attempts in the hours before and millions of attempts afterward. The US National Security Agency told organizations to patch the flaw immediately or take affected systems offline. France and Finland temporarily limited access to some websites while patching work continued.

What has happened so far

• The PHP Foundation disclosed a critical PHP vulnerability on Oct. 21, 2026.


• Cloudflare recorded thousands of exploitation attempts shortly after disclosure, followed by millions more.


• The NSA urged immediate patching or offline action for affected systems.


• The UK government is asking citizens to be ready for emergencies that could cut off water, electricity, or the internet.


• Railway said an attacker accessed and decrypted customer credentials and API keys.


• Quest Diagnostics confirmed a breach of private patient health data.


• Indian firm eMudhra said eight of its digital certificate authorities used weak keys.


• GitHub suffered a major service disruption.

Why experts say it could worsen

The main reason attacks are escalating is that artificial intelligence has changed the economics of hacking. What once required nation-state resources and highly skilled attackers can now be done by a less experienced person with access to AI tools.

Experts say AI is finding flaws faster than they can be fixed. Rob Hamilton, a Bitcoin security researcher with the Bitcoin Red Team, said the situation is serious. Jonathan Riss, an analyst at CertiK, noted that a single weakness in shared infrastructure can affect many organizations at once. AI entrepreneur Matt Shumer said AI lets non-technical users find and exploit weak spots, leaving defenders struggling to keep up.

Some figures quoted in the source described the situation in strong terms. NEAR founder Illia Polosukhin said, "We are at Security Armageddon now." Anthropic's chief security adviser Jason Clinton warned that conditions could worsen before improving. These are opinions from individuals, not official government or agency statements.

Steps individuals can take

Security experts offered practical advice for everyday users. Recommendations include avoiding sites you do not know and not entering passwords or card numbers there until the situation stabilizes, because smaller sites may be the least likely to have patched their software.

Other advice covers personal device hygiene. Users were advised to delete unused apps, unplug smart gadgets they do not need, keep some cash and several days of groceries at home, and lock down personal access points while keeping their online footprint small. Turning on multi-factor authentication, ideally with an authenticator app or a hardware security key rather than text messages, can block login even if software is compromised. Passwords should never be reused, and old app permissions should be reviewed and removed.

What this means for crypto users

The surge in security incidents has led some crypto holders to look for alternatives and some experts to question self-custody, the practice of holding digital assets in your own wallet rather than on an exchange. Bitcoin advocate and Casa chief security officer Jameson Lopp argued that giving up your keys does not remove risk, it simply moves it to a place you cannot see or control.

Riss recommended splitting money into a hot wallet for amounts you plan to spend and a hardware wallet for long-term holdings. He also said users should read what they are approving before signing. These steps can reduce the impact of an attack on a user's own accounts, but they cannot prevent compromises of large shared platforms.

What is still unclear

The article does not give a total dollar amount of losses from Black October, a final resolution date, or a confirmed timeline for the next wave of attacks. Some claims that infrastructure could be cut off, including warnings from UK officials and US military preparation plans, are reported by the source but not independently verified here.

Source

• Cointelegraph, "Cybersecurity's Black October: How to protect yourself," Oct. 28, 2026.