Black October: AI found a hole in the software behind most of the web
The short answer
Security researchers using AI found a serious vulnerability in PHP, the programming language behind as much as 70 percent of websites. UK and European government sites, parts of the Wikipedia family and the Internet Archive went offline briefly this week while engineers patched. Those outages were preventive shutdowns, not breaches. The week has picked up the name Black October.
What was found
PHP is the plumbing under a large share of the web. It is old, it is everywhere, and it is exactly the kind of infrastructure nobody looks at until it breaks. According to reporting this week, researchers used AI to locate a serious security flaw in that layer, and it was serious enough that engineers chose to switch sites off rather than leave them running while they worked.
The significance is not that AI found a bug. Automated scanners have found bugs for twenty years. The difference is what the current models can do with context: read unfamiliar codebases, follow a chain of dependencies, and land on a flaw that human reviewers had walked past. That is a new kind of finding speed, and the defensive side has not caught up.
Why the sites went dark
Government sites in the UK and Europe briefly went down earlier this week, as did some sites in the Wikipedia family and the Internet Archive. It is worth being precise about what happened, because the natural reading is wrong. Those outages were not hacks. They were engineers taking services offline to patch before someone else found the same hole.
That is the shape of this whole story. The damage so far is disruption from defence, not theft. The risk is everything that has not been patched yet, especially older sites running PHP with nobody maintaining them.
Why banks are in the same story
The security panic arrived in the same week as a quieter story about AI agents inside bank accounts. Axios reported that banks are detecting more unauthorized third-party agents operating in their systems, and that executives described the situation as horrifying, largely because a bank cannot reliably tell whether an agent has the account holder's permission or not.
Both stories come from the same place: software that acts on its own is now normal, and the systems it acts on were built assuming a human at the keyboard. We covered the bank side here: US banks are blocking AI agents from customer accounts.
What to actually do this week
Most of this is not in your control. What is in your control is the boring layer, and this week is a good reason to finish it.
Install the updates you have been postponing. The flaw of the week is in server software, but your phone, browser and laptop have their own unpatched holes, and updates are the only cheap fix that exists.
Turn on multifactor authentication everywhere, then move to passkeys where offered. An AI-assisted attacker with a working password still has to get past a second factor.
Expect better phishing, not worse grammar. The old tell was clumsy English. That tell is gone. Our checklist for spotting it is here: how to tell an AI-written phishing email from a real one.
Stop giving agents shared passwords. If a tool needs access to your accounts, use a scoped credential you can revoke. The four layers that matter are in our permissions guide.
What nobody knows yet
Whether the same AI capability that found this flaw has already been used to exploit others that were never disclosed. How many older sites are still running the vulnerable code and have no one to patch them. And whether the labs will keep publishing what their models find, which is the difference between a bad week and a bad year.
Questions people ask
What is Black October?
An informal name security researchers gave to the week of AI-assisted vulnerability discoveries in October 2026, after AI tooling found a serious flaw in PHP and major sites were taken offline to patch.
Were Wikipedia and the Internet Archive hacked?
No. They went offline as a precaution while engineers applied fixes. The outages were preventive, not the result of a breach.
Is my website affected?
If it runs PHP, and most do, ask your host whether the patch is applied. Managed hosts have been rolling it out; self-hosted sites are the ones at risk.
Read next: the six controls that would have stopped the incidents