How worried should I be about the AI hacking panic and “Black October”?

Global cybersecurity authorities declared a state of emergency this week after artificial intelligence systems identified critical, decade-old vulnerabilities in PHP, a programming language that underpins approximately 70 percent of the web. The discovery triggered a wave of precautionary outages across government and commercial sectors in the United Kingdom, Europe, and the United States. Officials described the incident as one of the most significant cybersecurity events in recent years, prompting immediate calls for users to install security patches and maintain emergency household supplies. The crisis began on Wednesday, October 21, 2026, when security researchers disclosed two critical flaws in PHP, dubbed "php2shell" by cybersecurity firms. These vulnerabilities allowed attackers to seize control of a website’s server without legitimate access, potentially enabling the theft of sensitive data such as passwords. The flaws had remained undetected for more than a decade because exploiting them required complex technical work that human analysts had not prioritized. However, AI-assisted research revealed the weaknesses rapidly. Following the disclosure, exploit attempts surged from thousands to millions within hours. In response, dozens of websites in the U.S., U.K., and globally were taken offline temporarily to allow administrators to install fixes. Among the affected sites were government portals in the UK and Europe, including the homepage of the Dutch House of Representatives, as well as parts of the Wikipedia family and the Internet Archive. The disruptions were not the result of active hacking but rather preventative measures by web engineers securing systems before malicious actors could leverage the gaps. The National Security Agency and Europe’s cybersecurity agency placed their operations on high alert during the period. OpenAI stated that its technology assisted in locating the bugs, describing the discovery as "one of the most impactful security issues in recent memory." The company noted that, to its knowledge, frontier AI found these vulnerabilities before attackers did. Wiz, a cybersecurity firm, ranked the findings among the most severe discovered in PHP and arguably in software history. Matt Shumer, a cybersecurity expert, compared the situation to discovering that millions of buildings share the same broken lock, noting that while the manufacturer has sent a fix, every building owner must install it individually, and many have not yet done so. The rapid identification of the flaw highlighted a broader shift in the cybersecurity landscape. CrowdStrike reported that instances of "agentic intrusions," defined as hacking conducted by autonomous or semi-autonomous AI, doubled in August compared to July, and doubled again in September. An information security officer at Anthropic warned that cybersecurity threats are likely to worsen before they improve. This trend extends beyond static code flaws to dynamic interactions within financial systems. Banks have detected increasing numbers of unauthorized third-party AI agents operating within their networks. While some of these agents may have been permitted by individual account holders, executives described the inability to distinguish authorized from unauthorized agents as a "horrifying" security risk. Reports indicate that hackers used AI models, including Claude and Grok, to automate attacks targeting over 400 banks in Latin America. In the United Kingdom, Prime Minister Andy Burnham addressed the public impact of the outage during a meeting on wildfire response. He advised citizens to keep three days’ worth of emergency supplies, specifically bottled water and non-perishable food, at home. Burnham stated that the nation had historically been reactive to emergencies and needed to adopt a more proactive stance. He emphasized that the goal was not to incite panic but to ensure households could withstand difficult situations involving war, online attacks, or natural disasters. During an interview on BBC Radio 5 Live, Burnham recommended staples like baked beans, soup, and Twiglets, while dismissing the idea of stocking wine as a primary emergency item. Defence Secretary Wes Streeting reinforced the urgency of the situation, stating that cyber incidents of this nature would become more frequent as AI made it easier to bypass traditional defenses. He cited threats from hostile states, organized criminal groups, and climate change. Speaking on the BBC program "Question Time," Streeting asserted that the UK faces a higher level of threat than at any point in his lifetime. The government’s advice aligns with guidance previously issued by the European Commission, which urged EU citizens to maintain 72-hour emergency kits containing food, water, cash, and power banks. The resolution of the PHP crisis relied heavily on the efforts of Ondrej Sery, a resident of Czechia who volunteers as a maintainer for the PHP project. Although he does not work for the PHP Foundation, Sery serves as the director of domain-name-system engineering at the nonprofit Internet Systems Consortium. Working with a small team, he helped automate the distribution of patches, allowing countless organizations to remediate the vulnerabilities quickly. Users on social media credited Sery with saving the internet, noting that his work was supported primarily by modest donations. Security experts advise individuals to fortify their digital hygiene in light of these developments. Recommendations include updating all software immediately, using password managers or passkeys with unique credentials of at least 16 characters, and exercising extreme caution against phishing attempts. With AI capable of cloning voices and mimicking human communication, distinguishing between genuine contacts and automated scams has become significantly more difficult. Users are urged to verify the authenticity of unexpected messages and avoid clicking on unfamiliar links. The National Cybersecurity Alliance maintains a list of basic safety practices designed to mitigate these evolving risks. While the immediate PHP threat has been managed through widespread patching, officials warn that this incident is unlikely to be isolated. The integration of AI into offensive cyber operations continues to accelerate, reducing the window of opportunity for defenders to identify and close security gaps. As AI labs develop more competent models and agents, the pressure on legacy infrastructure increases. For now, the defense strategy relies on a combination of rapid technological patching, heightened institutional vigilance, and individual responsibility in maintaining robust personal security protocols.