“Black October”: how AI triggered a wave of hacks and how to protect your crypto assets

Key points:

• On October 21, the PHP Foundation disclosed critical vulnerabilities in the language that powers about 70% of websites – within hours, exploit attempts climbed into the millions.
• Railway, Quest Diagnostics, eMudhra and GitHub were hit by leaks, weak keys and outages in the same days.
• Experts advise keeping large sums in a hardware wallet, enabling two-factor authentication and never signing transactions blindly.

Cybersecurity professionals are already calling October 2026 “black.” NEAR founder Illia Polosukhin described what is happening as “Security Armageddon,” while Anthropic’s chief security adviser Jason Clinton warned that things will only get worse.

How PHP vulnerabilities set off “Black October”

It all started on October 21. The PHP Foundation disclosed critical vulnerabilities in PHP, the language that runs about 70% of the world’s websites. Researchers at Wiz Research found them using OpenAI technology. The bugs had existed for decades and allowed attackers to take over a server, steal data or deface a website. The foundation released two patches and urged everyone to update immediately.

The hackers moved faster. Cloudflare CEO Matthew Prince described how the number of attacks grew.

• 10 hours before the disclosure – thousands of exploit attempts.
• 45 minutes after it – tens of thousands.
• 2 hours after – hundreds of thousands.
• A few hours later – millions.

Authorities began taking websites offline. In the UK and Finland, dozens of government services went offline, and in France, local administration sites went down. The US NSA urged organizations to install the patches or disconnect vulnerable systems.

Which other companies were hit by hacks in October

On the same day, the Railway cloud platform warned that a hacker had accessed customers’ environment variables and may have decrypted them. These variables store API keys and database passwords. According to Railway, the attack was part of a series of attacks on AI providers. The platform paused all deployments and asked users to rotate their secrets.

Eight certificate authorities with weak keys were found at the Indian company eMudhra. Attackers could use them to impersonate trusted websites.

Quest Diagnostics confirmed a leak of patients’ medical data, and GitHub suffered a major outage. CertiK analyst Jonathan Riss noted that a single weakness in shared infrastructure opens access to many companies at once. Finding a vulnerability is now faster, but fixing it is not.

How to protect crypto wallets and accounts from hackers

According to AI entrepreneur Matt Shumer, AI lets even people with no technical background find and exploit vulnerabilities. Defenders cannot keep up. Users cannot stop an infrastructure breach, but they can limit their losses.

• Keep only your everyday spending money in a hot wallet and the rest in a hardware wallet.
• Read what you sign and never approve transactions blindly.
• Enable two-factor authentication via an app or a hardware key, not SMS.
• Use a unique, strong password for every service.
• Revoke access for apps you no longer use.
• Do not enter passwords or card details on unfamiliar websites.

Casa chief security officer Jameson Lopp warned against giving up self-custody. In his view, handing your keys to a third party does not remove the risk. It moves the risk somewhere you cannot control it.