Black October: 70% of websites worldwide threatened by major security flaw

Over the course of October, a run of AI-assisted cyberattacks hit websites, online services, and organizations worldwide. At the same time, researchers discovered serious security flaws in websites and platforms that millions of people use daily, making them vulnerable to attacks. The most sweeping threat came from the discovery of a flaw in PHP, a scripting language that powers roughly 70% of websites, according to the Guardian.

These back-to-back incidents have been dubbed “Black October.”

What happened during Black October?

On October 21, researchers disclosed two significant security weaknesses in PHP. Exploitation of this popular general-purpose scripting language could let attackers take over servers and read sensitive data. Patches exist, but they only protect sites whose operators install them.

While this is one of the most alarming cybersecurity incidents that occurred this October, it wasn’t the only one:

• Researchers discovered a prompt-injection flaw in an AI assistant: Salt Security researchers disclosed on October 1, 2026 that a malicious instruction hidden in an email could hijack Manus, an AI assistant, and reach linked accounts. The only action required from the victim was asking the assistant to read their inbox. The flaw has reportedly been fixed, but the incident demonstrates the possible dangers of giving AI assistants access to personal accounts.
• More than 100 companies breached in an AI-assisted hack: A Reuters investigation published October 19 reported that a hacker used AI agents to probe over 1,200 websites and breached more than 100 companies’ sites, with the agents doing most of the work. How much data was stolen hasn’t been disclosed.
• A cloud platform was compromised: On October 21, Railway, a platform developers use to build and host apps, disclosed that unauthorized parties accessed systems storing customer credentials. The company urged customers to change their keys and passwords.

Separately, Axios reported that banks are uneasy about customers giving AI agents access to their accounts, as this could potentially allow agents to take actions they weren’t asked to. That isn’t a cyberattack, but it highlights concerns about how much control these tools may end up with.

How Black October could threaten your identity

Black October could be one of the worst online security crises in history, and your personal information could be at risk. Because major security flaws were discovered in technology used by around 70% of websites worldwide, that means millions of sites are potentially exposed and vulnerable to data breaches. Security updates are available, but affected website operators or their hosting providers still need to apply them.

Governments, hospitals, and businesses have taken their services offline as hackers have already made millions of attempts to take advantage of these weaknesses. The personal information you trust these places to protect could be at serious risk and, if exploited, could lead to identity theft.

Why AI assistants raise the stakes

AI assistants and autonomous agents are opening up a new kind of AI-powered identity threat. Integrating them with your email, files, or bank accounts hands them considerable reach, and if an attacker manipulates the assistant, the fallout can include drained funds, hijacked accounts, and exposed personal data. The Salt Security case illustrates the danger: an assistant that reads a malicious email can be turned against the very person it serves.

Practical steps to take now to protect yourself

Black October exposed the increased cybersecurity risks that have come with the spread of AI. Taking smart, proactive steps can help keep yourself and your identity safer:

• Change important passwords: Start with your primary email and financial accounts. Use a unique, strong password for each login, and turn on passkeys or two-factor authentication wherever available. A password manager can help make this manageable.
• Review app permissions: Review which AI tools have access to your Google, Apple, and Microsoft accounts and remove anything nonessential. Configure AI tools to ask before sending messages or making purchases, and never give them your bank login.
• Be wary of links in breach follow-up messages: Scammers are citing recent breaches in messages like “your account was affected, verify now” to capture passwords and two-factor codes. Rather than clicking a link in these notices, open the company’s app or type its address yourself.
• Don’t assume a padlock symbol means an account is safe: A lock icon only means the connection is encrypted, not that the site is trustworthy. Some Black October incidents involved stolen certificate keys, which could let attackers build convincing fake pages.
• Consider using identity theft protection software: Names, phone numbers, birth dates, and addresses leaked in breaches give criminals what they need to impersonate you. Real-time protection provided by tools like LifeLock Advanced can help proactively monitor for and alert you about threats to your identity. With LifeLock, if you become a victim of identity theft, U.S.-based Restoration Specialists do the hard work on your behalf to help fix it. 

AI is amplifying both cyberattacks and scams, so these practical habits matter more than ever. Auditing the permissions you grant to AI, using unique passwords, and independently verifying links in suspicious messages go a long way toward protecting your identity.