“Black October” is the name the internet gave to a rough week for cybersecurity in October 2026. Within a few days, a critical bug in the language behind most websites, a broken certificate authority and several AI powered attacks all hit the news at once. As a result, people started sharing scary posts about the internet going down.
So what really happened, and should you worry? This guide explains Black October in simple words, separates facts from rumours, and gives you clear steps to stay safe, whether you own a phone, a bank account or a website.
Quick answer: Black October is a nickname, not a single attack. It covers a cluster of security incidents disclosed between about 19 and 22 October 2026. The biggest was PHP2Shell, two critical flaws in PHP that AI tools helped find. Fixes are out. There is no evidence of a planned internet shutdown, but it is a good moment to update your devices and tighten your logins.
Where did the name Black October come from?
The term spread after a widely shared post on X on 22 October 2026 called the previous 48 hours the most serious in cybersecurity history. News sites such as Axios and 404 Media picked it up the same day.
However, many experts pushed back on the drama. Some analysts called it a disclosure wave rather than an attack wave. In other words, many problems were older and simply became public in the same few days.
What happened during Black October?
| Incident | What happened |
|---|---|
| PHP2Shell | Two critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, could let attackers run code on servers. PHP shipped fixes on 21 October. |
| eMudhra certificates | Eight certificate authority keys were created so weakly that they could be worked out. About 30,000 certificates need replacing. |
| Storm-0940 | Microsoft linked a supply chain attack through ConnectWise, reaching over 2,250 cloud tenants, to a group using an AI hacking framework called ARTEX. |
| LiteLLM | A hijacked release of this AI gateway shipped code that stole login secrets. |
| Railway | The developer platform told all users to replace their secret keys after an attack. |
| AI agents in banks | Axios reported that major banks found third party AI agents inside customer accounts. |
PHP2Shell was the biggest story
PHP runs a huge share of the web, including WordPress. Security firm Wiz estimated that about 70% of websites use it. Security researchers found the PHP2Shell flaws earlier in 2026 with help from AI models made by OpenAI and Google, and a coordinated fix was planned for about two months.
Then the details leaked a day early. According to The Register, Amazon saw an exploit attempt on 17 October, before any patch existed. Cloudflare saw thousands of attack attempts before the announcement and millions soon after. Meanwhile, the US NSA and CISA told organisations to patch right away or take systems offline. Some government sites in Finland, the Netherlands and France went offline as a precaution.
If you run a website, our PHP2Shell guide shows how to check your server and fix it.
Certificate trouble at eMudhra
The second big story was about the digital certificates that make the padlock appear in your browser. Weak keys at eMudhra mean some certificates can no longer be trusted, and browsers are removing them. We explain who is affected in our eMudhra certificate guide.
Why AI made Black October different
On the defence side, AI models helped researchers find a bug that had hidden in PHP for more than ten years. On the attack side, Microsoft said the Storm-0940 group used an AI agent framework to scan, guess passwords and break into cloud accounts at machine speed. In some cases, attackers went from first contact to high level access in under three hours, according to the Microsoft Security Blog.
Consequently, the time between a bug going public and attacks starting has shrunk to hours. OpenAI CEO Sam Altman said around the same time that defenders can no longer expect to patch every bug, and the approach has to change. You can read more in our article on Sam Altman and AI cybersecurity.
The bank story shows another new risk. Many people now give AI tools their bank logins so an agent can pay bills or track spending. Most of these agents did what users asked. Even so, some major US banks started blocking them, because a hijacked agent with your password is a serious threat. If you are new to the idea, see what an AI agent is.
Free: AI Tools Cheat Sheet 2026
24 free tools sorted by task, a simple prompt formula and 10 prompts you can copy. We send the PDF straight to your inbox.
Sent! Check your inbox
We emailed the AI Tools Cheat Sheet to you. Not there in 2 minutes? Look in Spam or Promotions.
Is the internet going to shut down?
No evidence supports that. Some viral posts talked about “internet lockdowns”, but no government or major company has announced anything like it. Many systems needed urgent patches, a few sites went offline briefly, and security teams worked long hours.
That said, Black October is a warning. AI tools will likely find more old bugs in the coming months, and attackers will move faster.
How to stay safe after Black October
These steps cover most of the risk.
Steps for everyone:
- Update your phone, computer and browser today, and turn on automatic updates.
- Use a password manager and a different password for every account.
- Turn on two step verification or passkeys for email, banking and social media.
- Be careful with links in texts and emails, because attackers often use big news stories as bait.
- Review which apps and AI tools can access your bank or email, and remove any you no longer use.
If you own a website:
- Ask your host if PHP is updated to a fixed version, or update it yourself.
- Update WordPress, themes and plugins.
- Change admin passwords and API keys if your site ran an old PHP version.
- Turn on a web application firewall if your host or CDN offers one.
Developers and small teams should:
- Replace any secret keys stored on platforms that reported breaches, such as Railway.
- Check if you used LiteLLM 1.107.0 and follow the project’s guidance.
- Keep logs long enough to look back for signs of earlier break ins.
Final thoughts
Black October was not the end of the internet. Instead, it was a clear sign that AI has changed the speed of both finding and using security holes. If you update your devices, protect your logins and keep your website patched, you have dealt with most of the risk. We will update this article as new details come in.
FAQ
What is Black October in cybersecurity?
Black October is a nickname for a group of serious security incidents made public between about 19 and 22 October 2026.
Was Black October caused by AI?
Not exactly. AI helped researchers find the PHP flaws, and some attackers used AI tools to move faster. However, many of the breaches started months earlier and were simply reported that week.
Is my phone at risk from Black October?
The biggest flaws affected web servers, not phones. Still, keep your phone updated and watch for scam messages that use the news as bait.
Will the internet shut down?
There is no evidence of a planned internet shutdown. Some government sites went offline briefly as a precaution while fixes were applied.