Black October: Why Cybersecurity Matters More Than Ever in the AI Age

October 2026 is being called "Black October" after two critical PHP vulnerabilities triggered a global wave of attacks. From Europe to Japan, public institutions and financial firms had to temporarily suspend services.

The lesson is clear: in the age of AI, vulnerabilities are found and exploited faster than most organizations can defend. Cybersecurity is no longer an IT cost; it is a guarantee of business continuity and reputation.

What happened in Black October?

Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) can, under certain conditions, let attackers run code on a server without authentication. Roughly 70% of websites use PHP. That does not mean 70% of sites were attacked, but it shows how wide the attack surface is.

According to Cloudflare CEO Matthew Prince, exploit attempts climbed to tens of thousands within 45 minutes of disclosure, hundreds of thousands within 2 hours, and then millions.

Global impact:

• Europe: In the Netherlands, the Overheid.nl portal, the Port of Rotterdam and some hospitals; public services in France, Germany, Belgium, Finland and Denmark were temporarily taken offline. UK councils including Oxford and Edinburgh saw outages.
• Asia: In Japan, financial firms including Mitsubishi UFJ Financial Group suspended some online services. South Korea raised its cyber alert level; China advised organizations to renew accounts and access keys.
• Türkiye: The Cyber Security Presidency issued a national warning and launched preventive measures.

Most shutdowns were precautionary; there is no verified count of successful breaches yet.

Three lessons from Black October

1. AI has multiplied the speed of vulnerability discovery. Former CISA director Chris Krebs noted that about 3% of all critical vulnerabilities ever discovered were found in the past month. Patching and detection capacity is not keeping pace.
2. The real goal is to move inside. Once on a web server, attackers first look for database passwords, service accounts and API keys in configuration files. The vulnerability opens the door; privileged credentials open the whole building.
3. "Rotate all access keys" is easier said than done. Without central credential management, it means weeks of manual work and new outage risk.

Why PAM is decisive: limiting the damage with KronPAM

Patches close today's vulnerability. Privileged Access Management (PAM) limits the damage of the one that will be discovered tomorrow. KronPAM makes every step an attacker needs after the initial breach harder:

For an organization running KronPAM, China's advice to "renew accounts and access keys" is not a weeks-long project; it is a central rotation policy.

Checklist for organizations

• Inventory every system running PHP and update to the fixed versions
• Restrict external access to, or temporarily disable, systems that cannot be updated
• Look for signs of compromise on systems running older versions
• Find every password and key embedded in applications and config files and bring them under central management
• Rotate privileged and service account passwords
• Review standing admin rights and move to JIT access
• Enforce MFA and session recording for access to critical systems

Conclusion

Black October showed that cybersecurity is more valuable than ever and is now a boardroom issue. No one knows when the next critical vulnerability will surface. Organizations that keep privileged access under control can turn that day's crisis into a manageable incident.

To assess your organization's privileged access risks together, get in touch with the Kron team.