Cybersecurity’s “Black October”

A wave of security incidents this week, many tied to AI, has led many to start calling it Black October. The most serious such incident was when PHP, the programming language behind 69% of websites, patched two critical flaws after they were revealed, and the NSA advised sites that couldn’t update to go offline. Meanwhile, Microsoft reported a China-state-aligned group using AI agents to attack hundreds of organizations, sometimes gaining privileged access in under three hours. One hacker apparently using DeepSeek and Claude Code broke into websites of more than 100 companies, at about $50 per hack.

As AI has improved, cybersecurity incidents have risen. Google counted 141 exploited vulnerabilities through August this year, more than in all of 2025. The same month, OpenAI and more than 100 other organizations warned that AI-enabled attacks would soon become far more widespread. In a Stanford talk, Sam Altman said, “I no longer think we’re going to be able to just patch all the bugs.” The trend reached a head this week. Former CISA director Chris Krebs said “3% of all critical vulnerabilities ever discovered have been found in the last month,” and Figma’s John Milinovich wrote on Thursday that several dozen attacks in the previous two days “would each have been the worst to happen in an entire calendar year.”