Cybersecurity professionals are enduring a bruising month. What has been dubbed “Black October” is not yet over, but it has already produced several dozen major cyberattacks and AI-identified vulnerabilities across the internet.

The turmoil escalated on Oct. 21, when the PHP Foundation disclosed critical vulnerabilities in PHP — the programming language that powers roughly 70% of all websites — after they were uncovered with the help of AI tools. The disclosure set off a global race to patch servers. Cloud services provider Cloudflare reported millions of attempts to exploit the vulnerability after it was made public, following thousands of attempts in the preceding hours.

Some countries, including France and Finland, temporarily pulled access to certain websites, while the US National Security Agency (NSA) warned organizations to patch the flaws immediately or take affected systems offline.

“We are at Security Armageddon now,” said NEAR founder Illia Polosukhin. Anthropic’s chief security adviser Jason Clinton warned that “as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better.”

Citizens of the United Kingdom are even being urged to “be ready” for an emergency — such as severe weather or cyberattacks — that could cut off access to critical infrastructure like water, electricity or the internet. US military installations, meanwhile, have been told to prepare for 90 days of independent operation under the FORTRESS initiative.

So how bad is Black October, really?

Beyond rushing out to stockpile canned food and walkie-talkies, is there anything else ordinary people can do to mitigate their exposure?

“It’s really bad. It looks like the rest of the internet is waking up to the reality we had three months ago,” Rob Hamilton, a Bitcoin security researcher involved in the Bitcoin Red Team, told Cointelegraph Magazine.

The past week or so has delivered a string of incidents. Cloud platform Railway disclosed that an attacker had accessed and decrypted customer credentials and API keys, apparently targeting AI providers.

Related: France is world’s most dangerous place for Bitcoiners: 90 attacks in 7 months

Medical testing giant Quest Diagnostics confirmed a breach of private patient health data, while Indian security firm eMudhra was found to have eight digital certificate authorities with weak keys that could potentially have let attackers impersonate trusted websites. Code hosting platform GitHub, meanwhile, suffered a major service disruption that highlighted how heavily the software world relies on shared infrastructure.

GitHub’s senior director of security, Austin Devers, said such incidents are a “clear reminder that reliability requires constant work,” because modern development is “so connected.”

Jonathan Riss, an OSINT (open-source intelligence) and blockchain intelligence analyst at blockchain security firm CertiK, told Cointelegraph Magazine: “What concerns us most is how a single weakness in shared infrastructure can expose many organizations simultaneously.” Unfortunately, he added, AI’s ability to find vulnerabilities is not matched by its ability to fix them: “Finding vulnerabilities faster does not automatically give us the capacity to resolve them faster.”

Why things are likely to get worse

One reason the problem is getting worse is that AI has changed the economics of cybersecurity. What once required nation-state resources and sophisticated hackers to pull off can now be achieved by a teenager in a basement somewhere.

AI entrepreneur and investor Matt Shumer said that AI enables non-technical users to find weak spots and exploit them, leaving defenders “racing to keep up.” “Every weak spot still has to be fixed, tested and installed on millions of systems run by people who are already stretched thin,” he said.

Devers added that AI-assisted security tools are “dramatically” lowering the barrier to “uncovering complex, deep-seated flaws in widely used codebases.”

Related: Keystone says website breach exposed hardware wallet buyers’ addresses

What can ordinary people actually do?

There are practical steps ordinary users can take to stay safer online during this volatile period.

Shumer recommends staying off sites you don’t know — and definitely not entering passwords or card numbers into unfamiliar sites “until this blows over” — since smaller sites are the “least likely to have patched.” He also suggests deleting any apps you don’t use and unplugging smart gadgets you don’t need. Keep some cash at home and enough groceries for a few days, “if you want to be extra careful.”

Devers says the best defense is “locking down personal access points and keeping overall footprints small.” That starts with turning on Multi-Factor Authentication (MFA) across all accounts, ideally using an authenticator app or hardware security key rather than text messages. “This acts as a circuit breaker and stops hackers from logging into your account even if the underlying software is compromised,” he said.

Never reuse passwords, he added. “Create strong, unique passwords for every site, and periodically disconnect old app permissions or third-party connections you no longer use.” Devices and web browsers should also be set to update automatically: “While platform teams work to fix cloud-level security issues on the backend, keeping your devices secure ensures hackers can’t use your personal hardware as a back door into your accounts.”

To self-custody or not self-custody

The alarming rise in security incidents has led some crypto holders to consider alternatives to self-custody — that is, moving funds to an exchange or other custodian rather than holding their own keys — and some experts to advise against holding one’s own keys. Others, such as Bitcoin advocate and Casa chief security officer Jameson Lopp, counter that doing so defeats the whole purpose. “You can only benefit from Bitcoin’s unique properties when you hold your own keys. [...] Giving up your keys doesn’t make the risk go away. It moves the risk somewhere you can’t see or control,” he said.

Riss recommends separating small amounts intended for spending into a hot wallet — an internet-connected software wallet — from longer-term holdings in a hardware wallet, a physical device that keeps private keys offline, and to “actually read what you’re signing rather than approving blind.”

These precautions can reduce an individual’s vulnerability to attack, but everyday users can only lock down local issues and have little ability to affect wider problems. You can “reduce blast radius,” Riss said, “not prevent infrastructure compromise.” So while users can improve their cyber hygiene, ultimately, “the structural burden sits with platforms and providers.”

Magazine: Scammer loses $4.8M stored on tampered Ledgers: Asia Express