Recent cybersecurity incidents, including the PHP outage and the Binance hack, highlight how rapidly the threat landscape is evolving. This month's cybersecurity round-up explores how governments and businesses are tackling this complex new reality.
1. Critical cybersecurity update forces global websites offline
Websites around the world were taken offline on 21 October as governments and businesses raced to patch two critical flaws in PHP, the programming language running 70% of the world’s websites.
Emergency shutdowns hit banking, airline, telecom and government services, as well as sites like Wikipedia and parts of the BBC, after AI models run by researchers identified the vulnerabilities.
The flaws, which were named ‘PHP2Shell’, meant that any websites based on PHP programming were potentially exposed to data theft or disruption. The US’ cybersecurity agency (CISA) urged companies to immediately patch the vulnerabilities, or take their systems offline until able to do so. The UK’s official cyber body also flagged the prioritization of internet-facing systems and continuous monitoring for any suspicious activity. The EU, Singapore, Australia and Japan issued similar alerts.
At first it was thought no hackers had managed to exploit the flaws, but CISA announced on 26 October that two new PHP2Shell vulnerabilities had been added to its ‘exploited’ list, without divulging any details about the cyber attacks.
While AI-related vulnerabilities are among CEOs’ top concerns in 2026, it was in fact due to AI that the PHP flaws, which had remained undetected for decades, were uncovered. “Demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” said Wiz Research, one of the cyber firms behind the discovery. “Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”
2. AI boosts both cyberattack and defence
Digging deeper into the relationship between AI and cybersecurity, Microsoft’s annual Digital Defense Report, covering threat activity between July 2025 and June 2026, finds that AI “has become both a tool and a target for attackers” and that both attackers and defenders are now able to “operate at machine speed”.
The hackers currently have the advantage, says the report, because AI-powered vulnerability detection often runs ahead of remediation efforts. “AI can effectively automate social engineering attacks of many types, circumventing language and skill barriers to give adversaries entirely new capabilities,” Microsoft says.
But basic phishing attempts also remain prevalent. More than 46 million business contact impersonation (BCI) attacks were detected during the course of the year, with the majority of initial messages using generic openers like, “Do you have a moment?” or “Are you at your desk?”. Microsoft warned that these emails are just “a conversation starter” and that “the fraud comes later”, once a rapport has been established.
Government agencies and public services were found to be the most targeted sector globally, at 27% of observed activity, up sharply from 17% in 2025 and significantly ahead of IT services.
The 2026 report also lays out 10 security priorities for organizations to help tackle these issues: Govern cyber risk at leadership level; defend identity; establish governance for AI; reduce exposure; establish cross-signal detection; create a continuous threat vulnerability management program; prioritize testing; secure software dependencies; participate in collective defence; prepare for future tech transitions.
Microsoft’s priorities echo the World Economic Forum’s recent white paper, Cybersecurity’s Strategic Inflection Point: A Senior Leadership Agenda for 2027, which positions cyber resilience as a foundation of economic stability and shows leaders how they can close the cybersecurity gap.
3. News in brief: Top cybersecurity stories this month
Largest crypto hack in history: The world’s biggest cryptocurrency exchange, Binance, was hit by a record $6.3 billion hack at the end of October, with analysts calling it the largest-ever crypto crime. Half of the assets were immediately frozen, reports The Guardian, but over $3 billion is still in the hands of the criminals, who are believed to be North Korean state-backed hackers – although the country has denied being involved. Investors have pulled $3.6 billion from Binance as a result of the heist, but the company says it has now covered 90% of the stolen funds and that the situation has stabilized, stating “deposit volumes have remained substantial”.
Hackers heat up Europe’s supermarkets: In October, internet-controlled fridges and freezers at hundreds of French supermarkets, including the Carrefour chain, were heated to 50C+ in an overnight cybersecurity hack, causing fires to break out and spoiling large volumes of food. The attack then continued at the start of November with supermarkets in Sweden, Belgium, Finland, Estonia, The Netherlands, Ireland and Luxembourg targeted in the same way. No one has yet claimed responsibility for any of the hacks, which the EU Commissioner for Agriculture, Christophe Hansen, called “a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it – a warning that we must take seriously".
London hospitals hack arrest: An arrest has been made in relation to the 2024 London hospitals cyber attack, which disrupted more than 10,000 appointments, caused weeks of disruption and possibly contributed to one patient’s death. German police have detained a Russian man accused of being part of the cyber-crime gang behind the hack, reports the BBC.
Albuquerque hospital hit by cyber attack: A cybersecurity incident at a major hospital network in New Mexico left the US state without its only Level 1 trauma centre, reports SecurityWeek. Ambulances were sent to other hospitals in the region and appointments were cancelled at more than 30 clinics.
AI foils poker fraud: An online poker player discovered his games were being hacked via an AI agent. The Claude agent spotted a programme called MeshAgent running in the background that is able to control the machine it’s installed on. Hundreds of players were found to have been targeted in this way, with millions of dollars reportedly being stolen, says Wired.
Increase in DDoS attacks: Security tech company Cloudflare said it blocked over 8,200 Distributed Denial-of-Service attacks every hour during the period July to September. This represents a 208% increase of attacks compared to the same quarter in 2025, says Cyber Security News.
Government employee database request: The US Department of Homeland Security has asked a hosting company in Iceland to take down or restrict access to a database of more than 40,000 of its personnel, reports Reuters. It said having the database available online puts the individuals at risk of “harassment, stalking and physical harm”, but the hosting company has so far not agreed to remove it.
4. More about cybersecurity on Forum Stories
Cyber resilience has become inseparable from economic resilience, yet the organizations that recover fastest from an attack are not those with the most threat intelligence – they are the ones with a pre-agreed model for deciding what to do under pressure. In this article, Sanjeev Mehrotra from Tech Mahindra sets out a ‘cyber resilience decision system’ and argues the real measure of resilience is how well organizations turn what they know into timely, coordinated action.
A new insight report from the World Economic Forum and Boston Consulting Group examines how jurisdictions can build credible regulatory frameworks for the ever-growing digital asset markets. Regulation of Digital Assets in a Shifting Global Landscape identifies nine dimensions that policymakers must consider, including tackling the issue of cybersecurity and financial crime. Read the full report here.
AI's growing power cuts both ways: the more capable the technology, the more useful it becomes to criminals and attackers. The global response has not kept up, argues Kat Duffy, Senior Fellow for Digital and Cyberspace Policy at the Council on Foreign Relations. She calls for a new government-private sector partnership – an international framework for cooperation, knowledge-sharing and enforcement – and explains in the video below that the blueprint already exists:
The World Economic Forum’s Centre for Cybersecurity provides an independent and impartial platform to reinforce the importance of cybersecurity as a strategic imperative and drive global public-private action to address systemic cybersecurity challenges
