Oct 23: Black October

A Major Internet Security Scare Raises New Questions About AI, Crypto and Bitcoin

Good morning, everybody.

It’s your Daily Crypto News for Friday, October 23rd, 2026. My name is Matt.

Today we’re doing something a little different. We’re not spending the entire episode talking about cryptocurrency markets. We’re talking about something being called Black October, a growing cybersecurity scare involving website vulnerabilities, software supply chains, artificial intelligence, and potentially millions of internet users.

But before we get into that, Bitcoin ETFs reportedly lost approximately $640 million yesterday. Not exactly the greatest day for institutional inflows.

And I want to give a shout-out to Obsidian Enoch, who wrote another thoughtful comment on Spotify about quantum computing and Bitcoin security. I appreciate it, brother. Although, man, you’ve got to shorten these comments a little bit.

I’m kidding. Mostly.

His comment brings us directly into today’s conversation because I think people are overlooking an important distinction between quantum computing and artificial intelligence.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Quantum Computing Isn’t the Only Threat to Bitcoin Security

Obsidian Enoch said he doesn’t believe quantum computing will break Bitcoin in our lifetime, although he wouldn’t dismiss the possibility.

Fair enough.

But I think the conversation is beginning to shift.

With quantum computing, researchers understand mathematical approaches that could threaten certain cryptographic systems. The limitation is building sufficiently powerful, reliable hardware.

With artificial intelligence, we already have enormous computing infrastructure. The question is whether researchers can discover more efficient mathematical methods that expose weaknesses in existing security systems.

Now, that doesn’t mean AI can currently derive Bitcoin private keys from public keys. There’s no demonstrated practical breakthrough establishing that capability.

But recent advances in AI-assisted mathematical research have people asking whether future discoveries could change the assumptions behind today’s cryptography.

Paul McNeil, who writes our evening newsletter at DailyCryptoNews.net, and I were discussing this last night.

Andreas Antonopoulos has made the broader point that if quantum computing can compromise Bitcoin’s underlying cryptography, society will have problems extending far beyond cryptocurrency.

I agree.

But Bitcoin has some particular concerns because blockchain transactions and certain public keys are permanently recorded.

One important distinction: a Bitcoin address isn’t necessarily the same thing as an exposed public key. The security implications depend on the address type and how the wallet has been used.

That makes the question of protecting older wallets and preparing for future cryptographic changes worth taking seriously.

But today’s main story isn’t somebody cracking Bitcoin.

It’s what’s happening to the websites and software we use every day.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

What Is Black October, and Why Is PHP at the Center of It?

Black October is a name being used in cybersecurity discussions to describe a wave of reported vulnerabilities, attempted exploits, software compromises, and other security incidents during October.

The biggest story we’re discussing involves vulnerabilities described as PHP2Shell.

PHP is a programming language used behind an enormous number of websites.

When you visit a website, your browser displays the page, images, forms, and buttons. But behind that interface, server-side software can be processing logins, communicating with databases, handling payments, retrieving account information, and interacting with APIs.

PHP is used extensively for those functions.

Estimates frequently place PHP on roughly 70% of websites whose server-side programming language can be identified.

That doesn’t mean 70% of the internet is vulnerable to this particular attack.

It means that when a serious PHP vulnerability appears, the potential exposure deserves attention.

The vulnerabilities described in the reports involve specially constructed requests that could trigger memory corruption under certain conditions.

In a vulnerable configuration, a successful exploit could potentially allow unauthenticated remote code execution.

That’s a complicated phrase with a pretty straightforward meaning.

An attacker might be able to make a vulnerable server execute commands without first logging into an authorized account.

And that’s a serious problem.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

A Legitimate Website Could Become the Attack

Here’s what makes server-side vulnerabilities particularly concerning.

Imagine you visit your cryptocurrency exchange. You use the same bookmarked address you’ve always used. Everything looks normal.

But the server behind that legitimate website has been compromised.

An attacker with sufficient control might be able to modify what the website sends to your browser.

That could potentially include fake login forms, malicious JavaScript, altered cryptocurrency deposit addresses, compromised wallet-connection requests, fraudulent software updates, or attempts to steal session cookies and API credentials.

And here’s why this matters especially for cryptocurrency.

If you authorize the wrong blockchain transaction or send funds to an attacker-controlled address, there may be no practical way to reverse it.

This isn’t the same as somebody automatically draining your wallet because you opened a webpage. An attacker generally still needs a workable path to obtain credentials, compromise software, or convince you to authorize something dangerous.

But a legitimate website that has been compromised can be much more convincing than an obvious phishing email.

Changpeng Zhao, the founder of Binance, has urged additional caution when visiting websites during this security scare.

And I think that’s reasonable.

We don’t need to panic, but we should understand what we’re dealing with.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Reports Describe an Explosion in Exploitation Attempts

According to the security reporting discussed in today’s episode, attempted exploitation was detected before the official patches became available on October 21st.

Amazon’s threat-intelligence team reportedly identified suspicious activity as early as October 17th.

Cloudflare also reportedly observed a sharp increase in malicious traffic following public disclosure.

One set of figures cited approximately 482,000 malicious requests, associated with around 122,000 attack sessions targeting 22,000 websites across 103 countries during an initial monitoring period.

Those are substantial numbers.

But here’s a distinction that matters.

An attempted exploit is not the same thing as a successful breach.

If attackers send millions of malicious requests, that doesn’t mean millions of websites have been compromised.

The numbers describe attempted activity. Confirmed compromises require separate evidence.

The broader Black October reporting also identified 48 cybersecurity incidents or major vulnerability events between October 1st and October 22nd, spanning AI-related attacks, critical vulnerability disclosures, data breaches, supply-chain compromises, and AI-agent incidents.

Those figures describe the collection of events being discussed, not 48 confirmed attacks caused by the same PHP vulnerability.

And I think that’s important because cybersecurity headlines can become confusing very quickly when unrelated incidents are grouped together.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Government Websites, Healthcare Systems and Software Supply Chains

The concern extends well beyond cryptocurrency exchanges.

Reports circulating during this period describe disruptions or precautionary shutdowns involving government services, financial institutions, healthcare systems, and other major organizations.

Among the organizations and sectors mentioned are the Port of Rotterdam, European government services, hospitals, the Internet Archive, telecommunications companies, and Japanese financial institutions.

There’s also reporting about a healthcare data breach involving approximately 1.4 million current and former patients.

But I want to be careful here.

We shouldn’t assume that every breach or service disruption reported this month was caused by PHP2Shell. A security incident occurring during the same period doesn’t establish a technical connection.

There have also been separate reports involving GitLab vulnerabilities and compromised software-release pipelines.

And supply-chain attacks are especially dangerous because they can compromise software before it ever reaches the end user.

You might download an application from what appears to be the correct source, only to discover that malicious code was inserted somewhere during development or distribution.

That’s an entirely different problem from somebody sending you a fake login link.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

AI Could Make Finding Software Vulnerabilities Much Easier

Here’s the part that concerns me most.

The cybersecurity industry has spent decades trying to identify weaknesses in enormous software systems.

Human researchers review code, test applications, and look for vulnerabilities. But there’s simply too much software for people to inspect everything.

Now we’re developing AI systems capable of analyzing massive codebases, identifying suspicious patterns, and assisting with vulnerability research.

That could be an extraordinary defensive tool.

Companies might discover and patch problems that have existed unnoticed for years.

But attackers can potentially use increasingly capable AI systems for similar purposes.

And that changes the economics of cybersecurity.

You don’t necessarily need an enormous team of experienced researchers if automated tools can help identify potential weaknesses much faster.

Of course, finding a suspicious piece of code isn’t the same as producing a reliable exploit. But the ability to accelerate discovery matters.

We’re also hearing concerns about AI agents operating inside financial accounts and whether institutions can reliably distinguish authorized automated activity from malicious behavior.

That becomes particularly complicated when legitimate customers are also using AI agents to manage tasks on their behalf.

Who authorized the transaction? Was it the customer, their assistant, or somebody who compromised the assistant?

Those are questions financial institutions are going to have to answer.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

What Should Cryptocurrency Holders Do?

Several cryptocurrency companies have indicated that their core infrastructure isn’t directly dependent on the affected PHP components, or that they’ve implemented additional safeguards.

But that doesn’t establish that every connected website, vendor, or service is completely protected.

For now, I think the sensible approach is straightforward.

• Avoid unexpected links in emails, Telegram, Discord, and social media messages.

• Don’t connect your cryptocurrency wallet to websites unnecessarily.

• Carefully inspect every transaction before approving it.

• Use hardware wallets and strong multifactor authentication.

• Keep your devices, browsers, and wallet software updated.

• Use trusted bookmarks, but remember that even legitimate websites can potentially be compromised.

And if you’re operating a website or business, make sure your technical team is reviewing relevant security advisories and applying appropriate patches.

There’s no reason to assume everybody’s money is about to disappear.

But there’s also no reason to be careless.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Crypto Prices

Despite the cybersecurity headlines, cryptocurrency prices are relatively stable this morning.

• Bitcoin: $81,550, down 0.2%

• Ethereum: $2,390, down 0.2%

• BNB: $746, up 2%

• XRP: $1.31, down 0.5%

• Solana: $104, unchanged

• TRON: $0.329, down 0.1%

• Zcash: $1,230, down 2%

• Hyperliquid: $77.95, down 0.2%

• Total market cap: $2.73 trillion, down 0.1%

• Fear & Greed Index: Neutral

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

My Take

Every Bitcoin market cycle seems to have its own version of FUD.

We’ve had fears about China banning Bitcoin, regulatory crackdowns, exchange failures, and now artificial intelligence and quantum computing.

Yesterday, we discussed Chamath Palihapitiya’s argument that Bitcoin could face serious problems from slowing adoption, custody risks, and an inability to coordinate future security upgrades.

I think some of those concerns are legitimate.

But we’ve heard that Bitcoin has run out of buyers at practically every major valuation milestone.

And here we are, with institutional investment products, corporate holdings, and banks building cryptocurrency infrastructure.

That doesn’t mean Bitcoin is invulnerable.

What Black October reminds me is that security isn’t just about Bitcoin’s underlying cryptography. It’s also about exchanges, websites, software dependencies, hardware, private-key management, and the people using those systems.

A perfectly secure blockchain doesn’t help much if somebody tricks you into authorizing a malicious transaction.

And AI makes the conversation more complicated because the same technology helping defenders identify weaknesses could also help attackers discover them.

I don’t think the appropriate response is to panic or declare Bitcoin dead.

It’s to recognize that technology changes, security threats evolve, and the systems we depend on have to evolve with them.

Thanks again to Obsidian Enoch and everybody participating in these conversations. You can leave your thoughts on Spotify or email me at matt@dailycryptonews.net.

I’ll see you Monday.

Happy HODLing