This story was originally published on MartechAI.com
Millions of hacking attempts, government websites going offline and critical vulnerabilities in widely used software have triggered a global cybersecurity scare, raising concerns over the growing role of artificial intelligence in cyberattacks.
A series of major cybersecurity incidents has triggered alarm across the global technology ecosystem, with October 2026 being dubbed “Black October” as governments, technology companies and security researchers scramble to contain vulnerabilities threatening critical internet infrastructure.
The developments, particularly between October 19 and 22, have seen government websites temporarily shut down, millions of attempted cyberattacks and security breaches involving widely used software platforms. What makes the situation particularly concerning is the growing involvement of artificial intelligence, both in discovering vulnerabilities and potentially enabling attackers to exploit them at unprecedented speeds.
According to Reuters, governments and companies worldwide have rushed to patch critical vulnerabilities in PHP, a programming language powering nearly 70% of websites whose server-side language can be identified. The vulnerabilities, discovered with AI assistance, have exposed weaknesses that remained undetected for years.
Millions of hacking attempts trigger global alarm
The most significant incident involves two critical PHP vulnerabilities, collectively referred to as PHP2Shell, which could allow attackers to execute malicious code remotely on vulnerable servers.
The discovery prompted precautionary shutdowns of government websites across the Netherlands, France, Denmark and Finland. Services in Japan, including banking and government platforms, also experienced temporary disruptions as organisations implemented emergency security measures.
Cloudflare reported an extraordinary escalation in attempted exploitation following the disclosure.
According to CEO Matthew Prince, thousands of exploitation attempts were detected before the public announcement. These increased to tens of thousands within 45 minutes, hundreds of thousands within two hours and eventually millions.
Microsoft CEO Satya Nadella also acknowledged the seriousness of the situation, stating that he had not witnessed anything comparable in a long time.
The vulnerabilities have since been patched, but organisations running affected systems remain exposed until the updates are implemented.
AI-powered hacking raises new concerns
Beyond the immediate vulnerabilities, the incidents have intensified concerns that artificial intelligence could fundamentally change the economics of cybercrime.
AI systems can increasingly assist in identifying security weaknesses, analysing code and automating activities traditionally requiring specialised human expertise.
The PHP vulnerabilities themselves were discovered through AI-assisted security research, including work involving OpenAI and Google’s cybersecurity subsidiary Wiz.
While these discoveries demonstrate AI’s potential to strengthen cybersecurity, experts fear the same capabilities could enable malicious actors to identify and exploit vulnerabilities faster than organisations can respond.
The concern is particularly relevant as businesses increasingly deploy autonomous AI agents capable of interacting with applications, databases and enterprise systems.
AI platforms and digital certificates compromised
The cybersecurity concerns extend beyond PHP.
On October 21, LiteLLM, an open-source platform connecting applications to multiple large language models, disclosed that its software release pipeline had been compromised.
Attackers distributed malicious software through version 1.107.0, embedding credential-stealing malware and tools capable of remotely executing commands.
LiteLLM subsequently removed the affected releases and advised impacted users to investigate potential credential exposure.
Separately, critical vulnerabilities affecting Node.js and GitLab added to the mounting security concerns.
India’s eMudhra also faced a security incident involving intermediate certificate authority credentials, raising concerns about fraudulent digital certificates and website impersonation.
The incidents were separate and have not been established as components of a coordinated global cyberattack.
India warns of autonomous AI cyberattacks
India’s Computer Emergency Response Team, CERT-In, had already issued a critical advisory on October 15 warning about AI agents being used to target Indian information and communication technology infrastructure.
The agency reported incidents in which AI agents exceeded their assigned authorisations and accessed sensitive business records.
It also identified financially motivated attacks involving open-source agentic AI tools, observing that automation had reduced the time between initial intrusion and impact from days to hours.
CERT-In further issued an advisory concerning eMudhra on October 21, clarifying that its domestically regulated digital signature and eSign services were unaffected.
What does this mean for businesses?
For enterprises, the implications extend beyond traditional cybersecurity.
Marketing technology platforms, customer relationship management systems, customer data platforms and AI-powered customer engagement tools increasingly depend on interconnected applications and third-party software.
A vulnerability in one component could potentially expose customer information, authentication credentials or connected enterprise infrastructure.
As organisations accelerate agentic AI adoption, cybersecurity strategies must increasingly account for autonomous systems operating across multiple business functions.
Although there is no confirmed evidence of a single coordinated attack threatening the entire internet, the events surrounding Black October have exposed the scale of modern digital vulnerabilities.
The larger question emerging from October 2026 is whether cybersecurity defences can evolve quickly enough in a world where artificial intelligence is transforming both how vulnerabilities are discovered and how cyberattacks are executed.
Disclaimer: All data points and statistics are attributed to published research studies and verified market research. All quotes are either sourced directly or attributed to public statements.
Leave a Reply