Something quite unprecedented is unfolding on the internet. It affects almost everyone who uses the internet, has online banking accounts, has ever made a digital payment on any website, has a smart home system, uses cloud storage, or does online shopping. That essentially means everyone.
A lot continues to unfold. In just the last few days, India’s largest bank, the State Bank of India (SBI) warned that almost 4,000 customer records were leaked to the dark web. Microsoft warned that a Chinese group called Storm-0940 is using artificial intelligence (AI) penetration to automate attacks targeting hundreds of organisations globally using a cloud backup service called ConnectWise.
There is a race to patch PHP, or Hypertext Processor, an open-source programming code used by millions of websites globally. Hackers have used AI agents to drive a cyberattack on 16 banks and investment companies in Korea. US banks including JPMorgan, Bank of America and Wells Fargo sounded the alarm earlier today that AI agents are now operating inside customer banking accounts as they scramble to block their actions (they fear unauthorized money movement).
No wonder cybersecurity experts are dubbing this ‘Black October,’ following warnings that AI-driven cyberattacks were imminent. Former OpenAI researcher Joshua Achiam sounded the alarm over the wave of various cybersecurity incidents earlier this week in a post on X. “Feels like March 1, 2020 for Cyber. Not normal, something is happening. Internet lockdowns in a couple of months?” he wrote on October 21. That may seem far-fetched for now, but the scale and diversity of cyberattacks is worrying.
The latest concern focuses on the PHP vulnerability called PHP2Shell, which would allow hackers to steal sensitive data or take control of unpatched servers. The interesting thing is that the vulnerability was revealed on social media on Wednesday, before the patch was readily available for every developer and IT department to install. Repercussions have been immense. Many websites were taken offline as a precautionary measure
PHP has been around since the 1990s, helping to build websites, and is still widely used today to work behind the scenes to collect information and generate content that is seen on web pages. At this stage, it is difficult to gauge the scale of patching by websites, till official confirmations come through.
Matthew Prince, Co-founder & CEO of Cloudflare, says the PHP2Shell exploit was drawing attention from hackers almost immediately. “In the 10 hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now,” he says, in a statement.
Industry-wide collaborations and an inflection point
AI company OpenAI had worked with maintainers, researchers, and security providers to address critical vulnerabilities in PHP, using the GPT-5.6 Sol model as part of the Patch the Planet initiative. Of course, they’re expected to push a case for their AI models as cybersecurity tools.
“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory. It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits,” they say.
Wiz Research, a cybersecurity firm explains that their own autonomous AI agent called Atlas alongside Google’s Gemini 4 Argon and OpenAI GPT-5.6 Sol, was used for the vulnerability search. They say AI helps adapt an exploit to different PHP versions, configurations and memory layouts. “This significantly lowers the barrier to scaling attacks across different deployments,” the company says in its research.
“Using Gemini 4 Argon, the team at Wiz has shown why frontier AI is a game-changer for cyber defense. For over a decade, these critical vulnerabilities remained unaddressed because vulnerability discovery and exploitation were incredibly complex. We’re pleased to see Gemini 4 Argon help defenders bridge that gap, finding vulnerabilities and helping patch them,” says Raluca Ada Popa, Head of Gemini Security, Google DeepMind
The timing is where things get interesting. Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17 in their telemetry, four days before the public disclosure of CVE-2026-109618 and CVE-2026-109619 vulnerabilities.
“The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” says CJ Moses, CISO of Amazon Integrated Security.
A smart home conundrum
If you think cybersecurity vulnerabilities such as PHP2Shell are a headache for IT admins in organisations and businesses, you’d be wrong. For consumers, their photos, music, data backups, online games, network-attached storage and all smart home accessories can potentially be at risk.
“The vulnerability allows an attacker to steal authentication tokens from server memory. These tokens essentially act like electronic passes, telling a website that the user has already signed in. As a result, an attacker may be able to access someone else’s account without entering a password or a two-factor authentication code, putting messages, documents, delivery addresses, order histories and other confidential information at risk,” explains cybersecurity firm Kaspersky.
Home cloud storage devices such as consumer NAS or network-attached storage services have become popular in recent years. They are vulnerable, which means your login credentials and the data in those accounts, is to. Popular NAS makers including Synology have confirmed these vulnerabilities impact their products such as Mail Station and Synology Calendar. They have released fixes for all affected products.
The overall patch landscape for smart home devices such as smart TVs, appliances, gaming services and other devices remains unclear.
Here’s what you can do
For most consumers, this may be a revision in the practice of keeping the software and firmware on their devices updated to the latest versions released by manufacturers. Kaspersky researchers say most people reuse the same password, or variations of it, across multiple websites. If an attacker finds one of those passwords on a vulnerable server, they may be able to compromise your other accounts as well
It is important to stay away from websites that a consumer isn’t familiar with, and stick to regularly used and trusted ones—particularly if it involves signing in with your Google account or Apple iCloud credentials, or making a transaction using a credit card or bank account.
This is particularly relevant for online banking websites and apps—if a financial services platform’s data is leaked as part of the ongoing vulnerability, hackers may try to communicate with an account holder in what may seem to be genuine-looking emails or messages to elicit more information—such as bank account credentials or credit card specifics.
Last but not least, setting up two-factor authentication (2FA) will go some way in mitigating attempts to gain unauthorised access to your online accounts if credentials do get accessed by hackers as part of their data haul from any website.
