It’s funny. I was in the middle of writing an article today about recursive self-improvement (RSI), trying to answer a question I’ve been thinking about for months: has AI already started improving itself?
I was going to publish that piece today. Instead, I’ve turned my attention to what is happening in the cybersecurity world.
A series of increasingly serious cybersecurity vulnerabilities, breaches, and AI-assisted hacking campaigns have all come to light in a matter of days. My entire X feed quickly filled up with security researchers sounding the alarms, with companies scrambling to deploy emergency patches and governments taking websites offline as a precaution.
Many online are now calling this Black October.
I’ve written a good amount online about how I think the future of the internet will unfold. Anyone that has used frontier-level AI can imagine how this technology could be deployed for nefarious purposes. The world is going to change forever as increasingly capable intelligence becomes cheaper and more widely available.
This month, we’re seeing the ugly side of AI on a broader scale.
While I don’t think we have enough information to confidently say the hard takeoff has begun, it is clear that something meaningful has changed. It is worth understanding what is happening, why it matters, and how you can protect yourself.
Let’s dig in.
What’s Actually Happening?
To put it very simply, we’re seeing three developments converge simultaneously.
AI is way better at finding security vulnerabilities. This became obvious back when Mythos was set to be released, but now intelligence is even cheaper. These vulnerabilities can potentially allow attackers to steal information and take control of and disrupt services.
AI agents can conduct cyberattacks autonomously. Work that once required a team of experienced hackers can increasingly be automated by a single person directing a swarm of AI agents.
Organizations are struggling to fix vulnerabilities as quickly as they’re being discovered. Vulnerable systems might be running in thousands of businesses or on millions of devices. Finding the problem and updating systems are two separate things.
Much of this isn’t new. Software has always contained vulnerabilities. What is changing rapidly is the speed and cost of discovering and exploiting weaknesses. Until relatively recently, finding obscure vulnerabilities took expertise, creativity, and patience.
Now, sophisticated offensive capabilities are accessible to far more people, often at a fraction of their previous cost. Every month, the barrier to entry gets lower.
Hundreds of agents can be run in parallel, continuously looking for potential problems, testing hypotheses, and reporting what they find. Useful if you’re trying to secure software, but considerably less reassuring when a person operating those agents wants to break into your business.
What is a CVE?
You may see this term more over the coming weeks.
CVE stands for Common Vulnerabilities and Exposures. This is an identifier assigned to a publicly documented security flaw.
For the PHP fiasco this week, CVE-2026-109618 is one of the two serious vulnerabilities disclosed. A newly reported CVE doesn’t mean that a successful hack occurred, only that a vulnerability was identified and documented. It could easily exist for decades without anyone noticing.
The rate we’re finding vulnerabilities is insane. According to Google, the average number of vulnerabilities observed being exploited has increased by approximately 71% in 2026 compared with 2025.
The change in the security landscape is clear. October has given us many uncomfortable examples of what it might mean.
The Black October Timeline
This will cover a handful of the significant developments, which is but a fraction of what has happened. Not all of these incidents are necessarily related.
October 15–16: Zeabur and ConnectWise
Zeabur: Hackers breached the cloud platform, compromising servers and potentially exposing customer credentials and API keys.
ConnectWise: A China-aligned hacking group used an AI penetration-testing framework called ARTEX in a campaign targeting more than 2,250 Microsoft 365 environments. Some organizations suffered privileged account compromises.
October 17–19: TeamUpdraft
TeamUpdraft: Attackers compromised connections to customer WordPress websites, creating unauthorized administrator accounts and installing malicious plugins. The company suspected AI assistance.
October 21: PHP2Shell, LiteLLM, Railway, and Node.js
This was arguably the most significant day, with several major security incidents disclosed within hours.
PHP2Shell: Two critical vulnerabilities were disclosed in PHP, the software behind much of the web. Attackers could potentially take control of vulnerable servers without authentication. Emergency patches were released, with exploitation attempts already observed.
LiteLLM: A popular AI development package distributed a malicious update containing credential-stealing malware, potentially exposing developers’ private keys and accounts.
Railway: The cloud deployment platform reported possible exposure of customer secrets, including API keys and database credentials.
Node.js: Several vulnerabilities were patched, including a serious remote-code-execution flaw. Vercel deployed emergency firewall protections for its customers.
GitLab: A critical vulnerability scoring 10.0/10 was patched, potentially allowing attackers to execute code on affected servers without authentication.
October 22: GitLab and Quest
Capcom: The Japanese game publisher disclosed a breach affecting approximately 11.77 million account records, including email addresses and account information. No AI connection has been established.
Quest Diagnostics: The major U.S. laboratory provider disclosed unauthorized access to its patient-record system. Patient information is believed to have been accessed, but the extent of the breach remains under investigation.
This is only a selection of what has happened. Other incidents involved additional cloud providers, software packages, and internet infrastructure.
And we still have a week left in October.
Why Is This Happening? Is This AI Takeoff?
I think the simplest explanation is that intelligence is getting cheaper faster than our infrastructure can adapt. The rules are being rewritten in real time.
AI agents can increasingly discover vulnerabilities, write exploits, and automate technical work that previously required skilled researchers. Meanwhile, organizations still need humans to investigate problems, test fixes, and update systems.
Attackers can move at machine speed. The world was not ready for this.
This brings me back to RSI, the idea that AI can help develop better AI, creating a feedback loop that accelerates its own progress.
Both Situational Awareness and AI 2027 explored how increasingly capable AI systems could transform research, engineering, and cybersecurity.
Does Black October prove that a hard takeoff has begun?
Not necessarily. Many of these incidents aren’t directly attributable to AI, and faster vulnerability discovery isn’t proof of RSI.
But cybersecurity may be one of the first places where the consequences of rapidly improving AI become impossible to ignore.
If these capabilities continue improving at their current pace, I suspect we’re going to see much more of this. There’s no sign of it slowing down.
What Can You Do?
Most people can’t do anything about the vulnerabilities themselves, but there are reasonable precautions worth taking.
Secure your accounts. Use unique passwords, a password manager, and passkeys or two-factor authentication, especially for email and banking.
Update your software. Keep your devices, browsers, routers, and any websites or servers you manage patched.
Limit AI agent access. Review which applications and agents have access to sensitive financial files and credentials. Understand what your exposure is.
Back up important information. Keep secure, preferably offline copies of documents, photographs, and financial records.
Prepare for disruptions. Consider keeping emergency cash and basic supplies in case banking or payment systems become temporarily unavailable.
Watch for scams. Monitor financial activity and verify unexpected requests through official channels. Scams are getting increasingly sophisticated and often look real.
None of this guarantees total protection, but it can reduce your exposure.
What Happens Next?
I think we’re entering an unclear transition period. We may look back on 2026 next year and view it with fondness as a time of relative stability. With the accessibility of agentic technology, the internet is going to evolve by necessity. A potential hard takeoff means we may encounter things soon that were previously inconceivable or deemed impossible.
The encouraging part is that AI can also help us discover vulnerabilities, deploy fixes, and strengthen critical infrastructure faster than ever before. But the game has changed, and we may need to rethink fundamental aspects of how we utilize and engage with the internet.
Above all, I encourage you to talk with your family and friends about what is happening. The more we are aware, the more we can prepare and help each other.
Thanks for reading.
- Chris