The Internet Is Under Attack: How to Protect Yourself, and Why the SaaS Era Is Drying Up

A thread by Matt Shumer went around this week with a blunt message: the internet is under attack, and everyone you know should hear about it. He called it the biggest cybersecurity moment in years, with some experts reportedly calling it "Black October." We went through it claim by claim. Some of it is documented and serious. Some we could not verify. And underneath the incidents sits a bigger shift that we think matters more than any single bug: when attackers have agents, the old economics of software, including per-seat SaaS, start to crack.

This is our version. Like our earlier essay on whether AI is taking us to a point of no return, it is an opinion piece. But every factual claim is sourced to our own reporting or flagged as unverified.

TL;DR

In plain English: the version for anyone

If the sections above feel like too much, here is the whole thing in a few lines.

What is going on? Software has hidden weak spots, a bit like a lock that can be picked. Computers are now very good at finding them, and criminals use the same tools. So more weak spots are found faster, and more people try to use them.

Does that mean I am in danger right now? Not in a way that should frighten you. Most harm to normal people still comes from tricks, such as a fake call from "your bank," not from clever computer attacks.

What do I do?

1. Install updates on your phone, computer and Wi-Fi router. An update is the new lock.
2. Turn on two-step login for your email and bank, so a stolen password is not enough.
3. Never tell anyone a password or a code that was texted to you. Real companies do not ask.
4. If someone contacts you about your money, hang up and call the number on the back of your card.
5. Do not click links in surprise messages, even if they look real.

What if I am not sure about something? Stop, and ask someone you trust. Scammers want you to rush.

We wrote a full, jargon-free walkthrough that you can send to parents, grandparents and friends: Internet safety for everyday people. It stays useful whatever the headlines are this week.

What is actually happening: verified, partly verified, unverified

Verified in our reporting

PHP2Shell. On October 21, 2026 the PHP project shipped emergency fixes for two critical bugs, tracked as CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10 by the PHP team. PHP runs about 70 percent of websites. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Details leaked a day early, Cloudflare reported attack attempts before the fix landed, and Amazon's security team said it had seen an attempt against a decoy server on October 17, per a search summary we reviewed. A search summary of one analysis put potentially vulnerable instances at 22.6 million, and noted that watchTowr reported exploitation in the wild while CISA said it had not observed it as of October 21. The researchers behind it, at Wiz, Calif and OpenAI, used AI models to find the bugs and build working attacks. Our full explainer is PHP2Shell: what happened and what to do now, and OpenAI's role is covered in the Brockman post.

Dutch and other sites going offline, and Wikimedia. Our PHP2Shell post reports several Dutch government and media sites going offline as a precaution and Wikimedia switching off a tool. We did not verify the thread's longer country list.

Ahold Delhaize. Reports say the Stop & Shop, Hannaford and Food Lion websites and apps were taken offline in mid-October after a cybersecurity incident, with online ordering suspended while stores stayed open. We found no confirmed restoration date, so the "more than a week" figure in the thread is plausible but we could not confirm it.

South Korea. Police are investigating AI-linked intrusions at financial firms, and CrowdStrike linked the activity to the ARTEX agentic pentesting tool. Note the number: the thread says 16 firms, but our reporting says seven financial firms and about 66,000 people exposed, per the probe. See our South Korea bank hacks post. The discrepancy may reflect different counting or later updates, and we have not resolved it.

Bank patching efforts. Bank of America said it added 1,000 contractors to patch flaws exposed by AI models such as Anthropic's Mythos. See that post.

Claims we could not verify

• The "swarms of AI agents" framing and the label Black October.
• A China-aligned group using an AI tool against more than 2,000 organizations through a backup service. Our searches found nothing on it.
• A cloud platform for about two million developers saying secret keys may have been accessed.
• India's largest bank reporting about 3,900 customers' details on the dark web.
• A criminal crew hitting more than 400 banks in Latin America.
• CrowdStrike saying AI-agent attacks doubled in August and again in September. We found CrowdStrike figures from earlier in 2026 (an 89 percent rise in AI-enabled adversary operations year over year, and 2.5 times more detections tied to AI-agent behavior than human-triggered activity in part of the first quarter), but nothing supporting a doubling in August and September.
• US banks finding unauthorized AI agents in customer accounts, attributed to Axios.
• Government warnings about attackers scouting water, energy and manufacturing systems with AI-written scripts.

Unverified does not mean false. It means we could not find a primary source in the time available, and you should treat each as a lead, not a fact.

Why AI makes this different

The thread's best point is the economics. For decades, finding weaknesses in software took rare, highly skilled people. That scarcity was a kind of protection. It is going away, for three reasons we can document:

1. AI finds bugs. PHP2Shell was found with AI help, and one researcher reportedly did in about a week what used to take a team months. OpenAI says its models found PHP2Shell and a Node.js remote code execution bug, and expects many more. Anthropic is scanning open-source projects too, as in our OSS Scanner post.
2. AI builds attacks. CrowdStrike tied the South Korean activity to an open-source agentic tool driven by a cheap model. Earlier incidents, such as the Hugging Face attack timeline, showed agents operating with little supervision.
3. Patching is slow. A fix must be written, tested and installed by every owner. Many sites never are. The thread cites about two weeks on average for serious bugs and a Cisco estimate that about half of internet-facing servers running a given software are too old to patch. We did not verify those figures, but the pattern, a long tail of unpatched systems, is well established.

The result is an asymmetry. Attackers need to win once. Defenders need to win everywhere, and the tools on both sides are improving every few months. The thread says offense is ahead of defense for now. That is plausible, and the 406-scientist letter urging airgaps for cyber-capable models, summarized in our post, shows how seriously researchers take the direction of travel.

Loop attacks: your stolen AI key becomes the attacker's engine

Internet under attack loop attacks: a leaked API key dropping out of a pocket

One pattern deserves its own section, because it is the part where AI makes attacks compound.

How the loop works. An attacker steals an AI API key, from an exposed repository, a hosting platform's stored secrets or a leaked configuration file. They load it into an automated attack tool. The tool uses your key to run an AI agent that scans more systems, finds more exposed keys and secrets, and feeds those back in. Every stolen key pays for the next round of attacks, and the bill lands on the victim.

What has been reported. We could not verify the specific dollar figures circulating, with people saying they saw bills of 12,000 to 20,000 dollars in minutes. But the shape matches documented cases:

• Help Net Security reported on October 16, 2026 on a tool called MONST3R-AI, sold as an autonomous pentesting platform, where buyers load stolen provider keys, set a budget cap and the charges land on the victims.
• A security report on a "Skynet" agent described a honeypot logging more than 127,000 external requests, much of it spraying stolen API keys.
• One account described nearly 200,000 API requests through a single compromised corporate account in about two minutes.
• A March 2026 case reportedly produced an 82,000 dollar Gemini bill from one stolen key in 48 hours, and stolen keys reportedly sell for as little as 30 dollars. That figure comes from a vendor blog and should be treated cautiously.
• Railway confirmed on October 21 that attackers read and in some cases decrypted customer secrets, aimed at AI inference providers, and OpenCode confirmed a breach on October 17. See our Railway and OpenRouter explainer and the OpenCode breach post.

Why it snowballs. Compute is the attacker's biggest cost. A stolen key turns that cost into your problem. Because agents work without rest and run in parallel, a spending spree can happen in minutes, and a normal monthly alert may fire too late.

The distillation connection

Stolen access to a strong model has a second use besides paying for scans: distillation. That means asking a top model a very large number of questions and training a cheaper copy on its answers. OpenCode described its breach as "a large scale distillation attack." Anthropic has separately accused Alibaba's Qwen team, DeepSeek and linked operators of running nearly 25,000 fraudulent accounts and 28.8 million Claude interactions to extract capabilities, per our coverage of that accusation, which is the company's allegation, not a court finding. A market for pooled or stolen accounts has grown up around it, as we describe in our AI token black market post. For background, see what AI distillation is.

This is cybercrime, not a gray area

It is worth being blunt. Using an AI key or account that is not yours is unauthorized access and, in most jurisdictions, fraud and theft of services. Reselling stolen access adds more offenses. Using stolen credentials to extract a model's capabilities may also breach contract terms and intellectual-property rules, on top of the criminal side. Where US law applies, the Computer Fraud and Abuse Act is the statute usually cited for unauthorized access; see our dictionary entry on the CFAA. Whether a specific act is criminal depends on the facts and the country, and this is not legal advice. The practical point for buyers: "cheap AI access" from an unknown seller is often stolen, and using it can expose you.

What to do about it

1. Cap spending per key, and set alerts at a fraction of the cap. A cap limits damage but does not stop theft.
2. One key per app, so a leak is contained and revocable.
3. Keep keys out of code, chats and screenshots. Use a secrets manager or environment variables, and scan repositories for leaked keys.
4. Rotate immediately when a platform you use reports a breach.
5. Restrict keys by project, IP address or allowed models where the provider supports it, and prefer short-lived tokens.
6. Watch usage by key and investigate unexplained jumps the same day.
7. Do not give agents your raw keys. Coding agents read files and run commands. A local policy layer that blocks an agent from sending secrets out is one control. AgentBeam, built by the agent security team behind explainx.ai, does this locally; see the setup guide.

What to do this week: the calibrated version

Internet under attack defense: a front door secured with two keys for multi-factor sign-in

The thread's advice is mostly sound. Here is our version, with notes where we would adjust it.

1. Update everything. Phone, computer, tablet, browser, router. Install updates through the device's own settings, not through a pop-up or a link in a message. If your router no longer gets updates, replace it. If you run a website, update PHP to a fixed version today.

2. Two-step login on email and banking. Your email is the master key to every other account. Add a password manager so every site gets a unique password. Your phone probably has one built in.

3. Treat every unsolicited message about your accounts as hostile. If someone asks for a password, or a code that was just sent to your phone, it is a scam, every time. Do not click their links or call the number they give. Hang up and call the number on your card.

4. Be wary of "update" and "certificate fix" offers. Attackers use real incidents as cover. A pop-up telling you to install a certificate or an update is a scam. Our eMudhra checklist explains the real certificate story, which is fixed by normal updates.

5. Be careful on untrusted Wi-Fi. Prefer your phone's data connection for anything sensitive.

6. Close doors you do not use. Delete apps you do not use and unplug smart gadgets you do not need.

7. Adjust the "stay off the web" advice. We would not tell people to avoid the web for weeks. We would tell them not to enter passwords or card numbers on sites they do not know, and to stick to well-known sites for sign-ins and payments this week. Reading is fine.

8. Do not pull your money out of the bank. Panic is what scammers count on. In the US, deposits at FDIC-insured banks are protected up to 250,000 dollars per person per bank, and federal rules generally limit your loss from unauthorized transfers if you report them quickly. Check your accounts often. Money you are tricked into sending yourself is far harder to recover, which is why scam calls are the bigger danger.

9. Keep a little cash and supplies at home. A normal emergency kit is worthwhile anyway.

10. Never give your bank login to an AI assistant or any other app. Only type it into your bank's own app or site.

Send it to the people least likely to hear about it

Parents and grandparents are the most targeted and least informed. Make the message short: update your phone, never share a code, and call the bank on the card's number if anyone contacts you. Set up two-step login for them in person if you can.

For developers and teams

Internet under attack runbook for developer teams as a sheet with three ticked steps

If you build or run software, this is the week to do the unglamorous work.

• Patch PHP to a fixed version, and check hosting providers and containers that bundle it.
• Update package managers and tools that bundle certificate lists. See the eMudhra checklist for uv, pip, certifi and container images.
• Rotate secrets if any platform you use reported possible exposure of keys. Assume a leaked key is in use.
• Rebuild and redeploy images, not just the host.
• Reduce exposure: put a web application firewall in front of anything public, close ports you do not need and remove forgotten staging sites.
• Watch your agents. Coding agents run with your credentials. Microsoft's agentic insider post argues for containment outside the model, and our guide to Claude Code permission modes covers the knobs you have.
• Check your own machine. A hot, slow Mac can be a miner, as in this Reddit story.

Where AgentBeam fits

Full disclosure: AgentBeam is built by the agent security team behind explainx.ai. It is an open-source (AGPL-3.0), self-hostable local security layer for AI agents. Its beam setup command installs hooks for Claude Code, Codex, Gemini CLI, Copilot CLI, Cursor and OpenCode, then blocks, redacts or logs risky agent actions locally. See our AgentBeam setup guide. Its relevance this week is simple. If your coding agent can read secrets, run shell commands and browse the web, it is an insider with your keys, and attackers know it. A local policy layer that stops an agent from sending secrets out, or from running a command you did not expect, covers a gap that patching does not. It is not a substitute for patching, and, as with any tool, test it on a throwaway project first.

Why the SaaS era is drying up

Here is the part we think matters more than any one incident.

For twenty years, SaaS ran on a simple deal: pay per seat, let the vendor handle security and updates. That deal rested on two assumptions: that humans are the users, and that the vendor will patch faster than attackers can exploit.

Both assumptions are cracking.

Humans are no longer the only users. In 2026, investors repriced software on the fear that AI agents will reduce the number of human seats companies pay for. Reports tied the selloff to the launch of Claude Cowork on January 30 and a Morgan Stanley note warning that autonomous agents threaten per-seat pricing. Estimates of the damage vary a lot by source, from about 285 billion dollars in 48 hours to around a trillion in lost software market value, and some analysts argue the selloff reflected sentiment more than a collapse in fundamentals. Treat the exact numbers as indicative. The direction is not in dispute: per-seat pricing is under strain, and vendors are exploring usage and per-interaction models, as in our post on headless SaaS and agents and our Copilot discounts coverage.

Vendors cannot patch faster than agents attack. If AI finds bugs in widely used code in days, every SaaS vendor sits on a growing pile of unfixed weaknesses, and every customer inherits that risk. The PHP2Shell story is a preview: a bug in a shared component hits millions of sites at once, and each owner must act. Bank of America's 1,000 added contractors show how much human effort catching up takes.

Customers start to ask different questions. If your vendor is a single point of failure, you want to know how fast they patch, what an agent could do with your data, and whether you can see and control what touches your accounts. That favors vendors who are transparent and agent-ready, and it favors tools you can self-host or audit. It is one reason open-source, self-hostable security layers are getting attention.

Software gets cheaper to build. When an agent can build a custom internal tool in an afternoon, the case for paying for a generic seat weakens for some use cases. Benchmarks of agents doing SaaS tasks, such as the one in our SaaS-Bench post, are vendor-reported and early, but they show where effort is going.

What "drying up" does and does not mean

SaaS is not disappearing. Systems of record, regulated workflows and anything needing trust, compliance and uptime remain valuable. What dries up is the easy money: thin wrappers, per-seat tools whose main job an agent can do, and vendors whose security posture cannot keep up. What grows is usage-based pricing, agent-friendly APIs and products that can prove they are safe to connect to an agent. The winners will be vendors that treat security as a product feature, and customers who choose accordingly.

What we got wrong, or might have

• We could not verify several headline claims, and may be understating some of them.
• The South Korea numbers differ between sources.
• The SaaS selloff figures come from mixed-quality sources, and the causes are debated.
• We are not security professionals advising you individually, and details change quickly. Check the vendor advisories for anything you run.

The point

This is not the end of the internet, and it does not require you to change your life. It requires a handful of boring habits, practiced now, because the people who will be hurt most are those who never hear about it. Update your devices. Lock your email and bank with two-step login. Never act on an unsolicited message about money. If you build software, patch PHP, update your trust stores and put guardrails around your agents. And watch the business model of software shift underneath all of it, because an internet where attackers use agents is an internet where the defaults of the last twenty years no longer hold.

Related reading

• PHP2Shell: what happened and what to do now
• Brockman on PHP2Shell and patching the planet
• The eMudhra checklist: update everything
• South Korea's AI-linked bank hacks
• AgentBeam setup guide
• Is AI taking us to a point of no return?
• Headless SaaS: agents that charge per interaction
• Microsoft: securing the agentic insider

Based on a viral thread by Matt Shumer and our own reporting and searches as of October 23, 2026. Several thread claims are unverified, and we say which. Details change quickly, so check official advisories.