Black October: protect your accounts as AI turbocharges cyberattacks

Through October 2026, a run of serious security failures — quickly nicknamed Black October — showed what cyberattacks look like when attackers point artificial intelligence at the problem. Researchers used AI to find a decades-old, critical flaw in PHP (the code behind a large share of the world's websites); a poisoned release of a popular AI tool (LiteLLM) stole developer credentials; weak keys at a certificate authority (eMudhra) undermined the padlock that proves a site is genuine; and a maximum-severity bug hit GitLab. Security leaders warned of a coming "vulnerability tsunami", and one provider said exploit attempts jumped from thousands to millions within hours of disclosure.

The uncomfortable takeaway from the experts: AI now finds and weaponises flaws faster than the world can patch them. You cannot fix the internet's plumbing. But almost every attack that reaches ordinary people ends the same way — someone logs into your account. That part you can control, and this guide shows you how.

Why this matters even if you don't run a website

You don't need to operate a server to feel the fallout. When attackers break into the services you use, the loot is credentials — emails, passwords, session tokens, API keys. Those get fed into automated tools that try them everywhere, launch convincing phishing at scale, and take over accounts to reach your money, your contacts, and your digital assets. The defences below assume the attacker is fast, automated, and patient — because now they are.

Do this first: switch to phishing-resistant login

The single biggest upgrade you can make is moving your most important accounts to passkeys or a hardware security key. Both use a standard called FIDO2 that is tied to the real website, so a fake login page — however perfect it looks — simply cannot capture anything useful. This is the one protection that holds up against AI-crafted phishing.

• Passkeys are built into modern phones, laptops, and browsers, and replace the password entirely for a growing list of services. Turn them on wherever they are offered.
• Hardware keys (such as a YubiKey) are small devices you tap or plug in. They are the gold standard for high-value accounts. Buy two — a primary and a backup — register both on every critical account so losing one never locks you out, and protect each with a PIN.

See our directory of two-factor and passkey tools to choose. Start with the account that can reset all the others: your email.

Lock the keys to your kingdom, in order

Work through your accounts worst-case-first:

1. Primary email — whoever controls it can reset almost everything else. Give it a unique passphrase and the strongest login method available.
2. Banking and payment apps.
3. Crypto, brokerage, and other asset accounts.
4. Your password manager, then everything else over time.

Use a password manager so every account has a long, unique password you never have to remember. If a service only offers text-message (SMS) codes, that is better than nothing — but prefer an authenticator app or a key, because SMS can be stolen through SIM-swap attacks. For the full walkthrough, see two-factor authentication and strong passwords.

Rotate what may already be exposed

Events like Black October spill credentials into the criminal market, where they power credential stuffing — automated attempts to reuse your leaked password across hundreds of sites. Get ahead of it:

• Check your email at haveibeenpwned.com to see which breaches include you.
• Change the password anywhere you reused one, starting with email and finance.
• Replace any password you have used in more than one place.
• In each important account, review active sessions and connected apps, and sign out or remove anything you don't recognise.
• Save your backup codes somewhere safe and separate, so adding a new key or losing a phone never locks you out.

Protect your online assets

If you hold cryptocurrency or other digital assets, treat them as a separate, higher-risk tier:

• Move long-term holdings to a hardware wallet (cold storage); keep only spending money on exchanges.
• Protect exchange accounts with a hardware key, and turn on withdrawal address allowlists and withdrawal delays where offered.
• Use a dedicated email for financial and crypto accounts that you never post publicly.
• Never enter your recovery phrase anywhere online — no legitimate service or "support agent" will ever ask for it.

If you run a website or write code

Black October was, at its core, a developer story. If you maintain any infrastructure:

• Patch now: update PHP, Node.js, GitLab, and other core software to the fixed versions, and subscribe to security advisories.
• Rotate secrets: assume exposed API keys, tokens, and credentials are burned — regenerate them, and rebuild any environment that may have pulled a compromised package.
• Harden your supply chain: pin dependency versions, verify signatures and checksums, and be wary of brand-new releases of critical packages.
• Enforce phishing-resistant login on your source control, cloud, and package-registry accounts — that is how the LiteLLM attackers got in.

You can't patch the world — but you can be a hard target

The experts are right that the next stretch will be noisy, and no individual can fix the internet's foundations. But the attacks that actually drain accounts still depend on one weak login. A weekend spent adding passkeys or hardware keys, cleaning up reused passwords, and moving off SMS codes puts you out of reach of the automated, AI-driven attacks that will define the months ahead. Do it now, while it's calm — and send this page to someone you'd hate to see hacked.