I’m Not One to Worry. This October, I’m Scared.

When the Risk Equation Changes

I’m not typically one to worry. Life carries risk, and so does business. As a leader, you weigh the likelihood and the impact against the time and money it takes to mitigate, make a decision, and move on. Most of the time you get it right.

You also go back and reassess the risks you accepted. Most often though, the items on a risk register tend to sit there a long time before anyone acts on them.

This month has me rethinking that whole register. The professional thing to say would be, “I’m concerned.” The reality is I’m gravely concerned. Honestly, I’m scared.

Cybersecurity Awareness Month Became Black October in 2026

October is Cybersecurity Awareness Month. This year, security professionals started calling it Black October. Here’s a partial list of cyberattack events this month:

• Citrix shipped fixes for three actively exploited NetScaler zero-days in about a week. The third exploit hit appliances that had just been patched for the first two.
• Microsoft’s October Patch Tuesday shipped a record 1,411 vulnerabilities. That’s more than Microsoft has issued in any previous full year.
• Attackers obtained a sensitive credential behind ConnectWise Cloud Backup and used it to break into customers’ Microsoft 365 environments, with the ability to read and write mail and files. Microsoft attributes the attack to a China-aligned group using an agentic AI framework.
• PHP, which runs a huge share of the web, shipped emergency patches for two critical remote code execution flaws known as PHP2Shell. Governments told organizations to patch immediately or take sites offline.
• Railway, a popular cloud platform for deploying apps, paused all customer deployments and told every customer to rotate their secrets after attackers decrypted some of them.
• Node.js fixed 10 vulnerabilities, including a high-severity flaw that could allow remote code execution.

AI helps attackers find vulnerabilities, build exploits, and run the attacks. Microsoft says the ConnectWise attackers used AI agents to scan, spray passwords, and abuse cloud app permissions at downstream victims, and pointed out that agents don’t sleep, take weekends, or stop for holidays.

How easy has this gotten? Dan Lorenc, CEO of security company Chainguard, said in a LinkedIn post that his team independently found the same PHP2Shell flaws by typing “find bad vulnerabilities in PHP” into a frontier AI model. Five words. PHP has been around for three decades and picked over by some of the best security researchers in the world, and those flaws escaped notice. If a short, simple prompt can surface them, the next flaw can be found just as easily. Turning a bug into a working attack still takes expertise, but AI is speeding that up, too.

Attackers Moved Before Defenders Knew

Matthew Prince, co-founder and CEO of Cloudflare, shared these numbers on X:

Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

– Matthew Prince, co-founder and CEO, Cloudflare

Read that first number again. Attackers were attempting to exploit PHP2Shell before most defenders knew it existed. Amazon saw exploitation attempts four days before the patches shipped.

I’ve been counseling clients on cybersecurity for more than 20 years. The ransomware wave and regulatory changes of 2015 to 2020 pushed many organizations to make the right investments. The last couple of years have been relatively light on cyber spending, and for good reason: the tools and processes were working. Attacks still happened, but they were usually contained quickly, and for most organizations with a focus on resilience and recovery, they were survivable.

That model assumed time. Time to detect, time to patch, time to let an accepted risk sit for a year. AI is letting attackers find a decade’s worth of vulnerabilities all at once, and security teams can’t keep that pace. Every decision on your risk register was made when the attack surface was smaller, the pace was slower, and your team could defend itself. Those decisions need a fresh look.

Recently I wrote about changing approval processes so security teams can move faster when the situation warrants it. The situation warrants it. Right now. Anthropic Deputy CISO Jason Clinton put a number on it this week: things will get a lot worse before they get better, and we need to hold on for about 18 months.

Here’s the part I’m hopeful about. Defenders have AI too, and it’s the reason Microsoft found and fixed 1,411 flaws this month. If we can get through the next 18 months or so, we’ll be running the most secure software we’ve ever had.

What Leaders Can Do Now

Anthropic’s Clinton also had advice for security leaders: never let a crisis go to waste. Go to your board and ask for help right now, “not for AI, for the basics.” I agree. Everything on this list is a security basic. None of it is new; much of it is already listed on the roadmap, waiting for budget. That’s the good news: you already know what to do. These are the same steps I’m walking through with clients right now.

• Dust off your last security assessment. Find the recommendations you deferred and get them deployed now. Then apply the same discipline to every critical vulnerability that lands. Build an inventory of everywhere the affected software runs, including network appliances and third-party products that bundle it without telling you. Isolate what you can’t patch right away. Monitor for signs of compromise. If a system was exposed before you patched it, assume it’s breached and investigate it that way. Then get it upgraded to a supported version so you aren’t having the same conversation next month.
• Get visibility. You need to see indicators of compromise quickly and block them. Too many organizations are running blind. If an attacker landed on one of your web servers tonight, who would know, and how fast?
• Segment your networks. Much of your IoT network doesn’t need internet access. That legacy application might need to be locked down so it’s reachable only through remote desktop infrastructure. Clinton warned back in August that there wouldn’t be time to patch critical infrastructure and called for network isolation including air gaps and data diodes.
• Get real about legacy code and legacy systems. AI makes finding vulnerabilities so cheap that going after older platforms makes sense for attackers again. And software vendors won’t save you. PHP’s fixes don’t cover 8.1 and older. Node.js 20 and older got no fix. October’s Patch Tuesday was the last one for Windows 11 version 24H2 Home and Pro. Nobody is going to patch that decade-old manufacturing software. Companies need to pay down this technical debt now.

Start This Week

If you’re a business, IT, or security leader and you feel uncomfortable about past IT and security decisions in light of what AI is now doing, you have good reason. Those decisions may have been reasonable when you made them. The pace has changed so dramatically that you need to reconsider all of them to see what risk you’re still willing to carry.

You don’t have to fix everything at once. If you’d like an additional perspective, I’m glad to talk.