404 Media22 Oct
AI Is Changing Everything About Hacking. No One Knows What Happens NextIf you missed it
The internet had a very bad week.
Here's what the world was reading, saying and doing between 17 and 23 October 2026.
PC Gamer23 Oct
'Every single week it's going to feel like the sky is falling': Cloudflare CEO says strap in for 'a couple years' of AI-powered internet security mayhemAxios22 Oct
Scoop: Unvetted AI agents are accessing U.S. bank accountsFortune22 Oct
The PHP bug marks a dangerous new era for the internet. OpenAI's poised to cash inEngadget21 Oct
Government websites in the EU and Canada taken offline over PHP vulnerabilityReuters23 Oct
Govts, companies take websites offline over PHP vulnerabilitiesJiji Press22 Oct
Japan PM Warns of Vulnerabilities in PHP Programming LanguageThe people running the internet
"I think we're going to have a couple years where every single week it's going to feel like the sky is falling."
"I no longer think we're going to be able to just patch all the bugs."
"As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better."
"Jason is 100% right. Code red."
The flaw "impacts the majority of the Internet."
"We're in the part of the movie where you need to throw whatever you can in the path of the zombies."
1 / 6
Who pulled the plug
PAUSEDJapanese banks
MUFG halted some online banking. Mizuho Bank and Daiwa Securities ran emergency maintenance. Shizuoka Bank switched off its app.
Jiji Press · 22 OctOFFLINEEuropean governments
Germany, France, the Netherlands, Finland, Belgium and Czechia took government sites offline as a precaution.
Reuters · 23 OctALERTNSA, USA
"If an immediate update is not feasible, it is recommended that organizations take the system offline."
NSA advisory · 21 OctALERTCERT-In, India
Rated the PHP flaws critical in note CIVN-2026-0510.
CERT-In · 21 OctOFFLINEWikipedia, Internet Archive
Took systems down as a precaution until they could be safely patched.
Reuters · 23 OctBLOCKEDUS banks
Morgan Stanley began blocking outside AI agents. JPMorgan, Bank of America and Citi are restricting them.
Axios · 22 Oct1 / 6
What is Black October?
Black October is the name people gave to the week of 17 to 23 October 2026. AI found two serious holes in PHP, the hidden code behind about 7 in 10 websites. The details leaked before the fix was out, attackers rushed in, and governments, banks and big websites went offline to patch. Three other security problems landed the same week, so the whole thing got one name.
Here's how it happened, step by stepChapter 1
First, understanding PHP
Every website has two parts: what you see, and the hidden machinery that makes it work. Black October happened in the hidden part.
Behind the page
<?php
// someone opened the home page
$page = "home";
$products = load_products();
$visitor = read_request();
foreach ($products as $p) {
show_card($p);
}
echo build_page($page);
?>
What the server runsBlack October lived down hereHello, festive season.New arrivals, every week.
Kurta set₹1,499
Diya lamp₹349
Gift box₹899
↔Drag the line · Illustration, not real code
What you see is built with HTML, CSS and JavaScript. The hidden part that does the work is very often PHP.
PHP runs on the website's computer, called a server. It has quietly powered online shops, news sites, blogs, college portals and government pages since 1995.
4 in 10of all websites run on WordPress, which is built on PHP.W3Techs
So when something breaks inside PHP itself, it isn't one website's problem. It's most of the internet's.
Chapter 2
So what was the hole?
Two flaws inside PHP itself, nicknamed PHP2Shell, let a stranger skip the login and run their own commands on a website's server. No password needed.
9.2 / 10
How dangerous experts rated both flaws. Critical.
No passwordA stranger could run their own commands on a website's server.
Inside PHPNot a plugin. The engine itself, under WordPress, Drupal and Wikipedia's software.
14 yearsEvery PHP version back to 2012 had at least one of the two.
Chapter 3
Who found it? AI did.
For 14 years, nobody saw how serious it was. Then AI security tools read through PHP's code and flagged it.
AI security reviewReading code...2 critical flaws found
function handle_request() {
$input = read_input();
$size = measure($input);
copy_into_memory($input, $size);Flaw 1 · leaks memory
$page = build($input);
return $page;
}
function unpack_upload($file) {
return unpack_all($file);Flaw 2 · runs outside code
}
AugAI tools at OpenAI and a security firm called Calif each found the flaw, separately. Wiz found it too.
🤫They told PHP quietly, so it could be fixed before anyone else knew. That's how it's meant to work.
+1Same week, OpenAI's Codex Security team found a second serious flaw, in Brotli, a compression tool used by Node.js and others.
The catch: AI can find flaws for anyone who asks. Defenders got there first this time. The race is getting shorter.
Illustration, not PHP's real code. Sources: SecurityWeek, Axios, The Hacker News.
Chapter 4
Then why is everyone panicking?
Because the secret got out before the fix did. Keep scrolling and watch the week unfold.
- AUGUSTAI finds it firstCalif and OpenAI report it to PHP privately. Wiz finds it too.
- 17 OCTFirst attempt spottedAmazon's decoy servers log an attack, four days before any fix.
- 18 OCTeMudhra certificates pulled8 of its certificate-authority keys were found weak and revoked. Chrome and Firefox block them.
- 20 OCTDetails leak earlyHow the flaw works gets out two days before the planned reveal.
- 21 OCTFix out. Rush begins.PHP ships the fix at about 7:20 pm IST. Within 45 minutes, tens of thousands of attempts, says Cloudflare. Government sites go offline on purpose. LiteLLM's poisoned update goes out.
- 22 OCTA name sticks"Black October" spreads. eMudhra exits the global certificate business. Some Japanese banks pause services.
Shape is illustrative. Exact daily counts weren't published.Sources: Help Net Security, SecurityWeek, Cloudflare CEO via TNW
The US agencies NSA and CISA told organisations to update right away, or take systems offline if they couldn't.
21 Oct 2026 · ExecutiveGov, SecureWorldChapter 5
Did anyone actually get hacked?
The part most headlines skip.
1,000,000+
attempts to get in
"Millions", says Cloudflare's CEO0
confirmed break-ins, so far
No successful attack confirmed by Germany, the Netherlands or Japan, as of 23 OctAttempt means someone tried the door. Break-in means they got through.
So why were websites down? Many went offline on purpose, to update safely.
CLOSED FOR SAFETYGovernment sitesFinland, the Netherlands and France took some offline as a precaution.
BACK SOONWikipedia and Internet ArchiveWikimedia took some systems down as a precaution. The Internet Archive went offline briefly.
PAUSEDJapanese banksSome paused online services. Payments between banks kept running.
WHAT YOU MIGHT HEAR, AND WHAT'S TRUE
"The internet is going down."
Some sites went offline on purpose, briefly, to patch safely.
"Hackers broke into millions of websites."
Millions of attempts. No confirmed break-in so far.
"My phone got hacked through PHP."
PHP runs on web servers, not on your phone or laptop.
"Indian digital signatures are unsafe now."
eMudhra says DSC, eSign and emSigner carry on as normal.
What it means for India
- CERT-In rated PHP2Shell critical (note CIVN-2026-0510, 21 Oct).
- No Indian government shutdowns or Indian victims have been reported.
- eMudhra, an Indian company, is leaving the global website-certificate business. It says that's about 1% of revenue.
- India's IT ministry pushed back on panic, saying some social media accounts were "indulging in fear mongering" about the eMudhra incident.
- CERT-In warned on 15 Oct that AI agents had read data at Indian organisations, mostly through exposed passwords and over-broad access.
Chapter 6
It wasn't just PHP.
Three other security problems landed the same week. That's why the whole thing got one name. Tap each card.
Separate problems, same week. Not one big attack. And nobody knows who said “Black October” first.
Chapter 7
So, what should you do?
Pick the one that's you. Tick things off as you go.
Five minutes, tops
-
Copy, paste, send
Hi, please confirm our website's server has the 21 October PHP security update (8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer). If it's on an older PHP version, please upgrade it. Thanks!
All done. You're ahead of most of the internet.
A 14-year-old flaw, found by AI, leaked and attacked within days. Fixed on 21 Oct. No confirmed break-ins so far. Update your stuff.
Before you act on this. This is our attempt to explain what happened, in our own words. We researched it carefully and every claim traces to a source below, but the facts are as of 24 October 2026, and stories like this move fast. Some details may change or turn out wrong. It isn't security, legal or financial advice. If you're acting on any of it, please check the latest from the sources, your web host or an expert first. We'll update this page if the facts change. Spotted a mistake? Tell us.
Sources (32)
- Sam Altman: "I no longer think we're gonna be able to just patch all the bugs" Gizmodo
- Certificate security incident eMudhra (official)
- CERT-In warns AI agents accessed Indian systems The Hacker News
- PHP2Shell vulnerability exploitation Recorded Future
- NSA advisory: critical patches recommended for PHP vulnerabilities NSA (official)
- Vulnerability note CIVN-2026-0510 CERT-In (official)
- Govts, companies take websites offline over PHP vulnerabilities Reuters, via Korea Times
- Cloudflare CEO: 'every single week it's going to feel like the sky is falling' PC Gamer
- What smart people are saying about the 'vulnerability tsunami' Business Insider
- Government websites in the EU and Canada taken offline Engadget
- The PHP bug marks a dangerous new era for the internet Fortune
- Japan PM warns of vulnerabilities in PHP Jiji Press
- eMudhra to exit global SSL/TLS certificate business Business Today
- Anthropic security chief issues stark warning Business Today
- Why eMudhra's exit is not enough (incl. MeitY statement) MediaNama
- LiteLLM hit by second supply chain attack this year Help Net Security
- PHP2Shell patches land as first exploitation attempts hit sensors SecurityWeek
- PHP2Shell vulnerabilities patched Help Net Security
- AI is changing everything about hacking 404 Media
- Millions of exploit attempts, no confirmed breaches The Next Web
- NSA and CISA urge immediate patching ExecutiveGov
- Who found the PHP bug; governments unplug websites Decrypt
- eMudhra certificates' private keys compromised Help Net Security
- eMudhra to exit global SSL/TLS business eMudhra
- Security incident, 21 Oct 2026 LiteLLM
- Brotli decoder flaw behind Node.js issue The Hacker News
- AI agents in bank accounts Axios
- PHP security flaw: which Indian websites are affected Free Press Journal
- CERT-In alert on AI agents Business Standard
- Black October is a disclosure wave Forkast
- Japanese banks pause online services Nippon.com / Jiji
- Usage of PHP for websites W3Techs
Quotes and headlines are reproduced word for word. Facts checked against these sources on 25 Oct 2026.
Did we miss
something?
Spotted a gap, want a part explained differently, or have a headline nobody's explaining? Write to us. We read everything.