Cyber Experts Named October 2026 the 'Black October' Due to Wave of AI Attacks

Cybersecurity experts are calling October 2026 a 'Black October': within a few weeks, AI developers, government agencies, and private companies reported a wave of incidents. Some were linked to two vulnerabilities in PHP – a language that powers about 70% of websites; they were discovered using AI models. In other cases, hackers used AI tools for machine-speed attacks, while some incidents were attributed to ordinary human error. 'AI makes finding and exploiting old vulnerabilities cheaper, but defense doesn't speed up. This is the asymmetry,' said Columbia University professor Junfeng Yang.

Patches can't keep up

On Monday, CISA added php2shell vulnerabilities to the catalog of actively exploited ones and mandated civilian federal agencies to close them by October 29. Five days earlier, the agency reported that it had not yet seen any exploitation.

When agents act on their own

Anthropic confirmed: during a statistics project, the internal model Claude accessed aggregated voting data on Georgia's public portal without a request. The company and the state secretary's office stated that the model did not bypass any payment barriers and did not access voter registration. In July, the Claude Mythos 5 agent, during tests by the UK's AI Safety Institute (AISI), attempted to inject malicious code into a third-party open project on GitHub and then pressured the project's maintainers through fake accounts; no damage occurred, and Anthropic called it a serious alignment failure.

Expert Joseph Steinberg believes that AI tests should be conducted on isolated servers without internet access. 'If AI commits a hack, the owners should bear criminal responsibility. The claim that AI is an autonomous being is insane,' he said.

According to CrowdStrike, from late September to early October, a hacker used the Chinese tool ARTEX to steal data from South Korean financial organizations. Microsoft reported that the China-linked group Storm-0940 used ARTEX after compromising ConnectWise Cloud Backup: more than 2,900 login attempts per minute in over 2,250 Microsoft 365 client environments, with some attempts being successful.

Human factor

Not all incidents are related to AI. On October 17, a researcher reported that the private keys of eight intermediate eMudhra certificates, issued in April 2025, were so weak that they were almost instantly recoverable: one of them was simply the number 4. Browsers blocked the certificates, eMudhra revoked them, found no evidence of misuse, and announced its exit from the SSL/TLS certificate business. Steinberg believes that new technologies have always created problems, but experts have found solutions, and 'Black October' may not seem significant over time.