Startup founder Colin Parsons woke up to roughly 50 billing notifications he never expected. He reported that his OpenAI and Anthropic accounts had racked up $449 in charges he didn't recognize. It was an expensive surprise that highlights how quickly stolen credentials can become a financial headache.

His experience comes as hackers increasingly use artificial intelligence to automate attacks at speeds that leave security teams scrambling. Meanwhile, researchers have uncovered dangerous weaknesses in software that helps power millions of websites.

Some cybersecurity professionals are calling this turbulent period "Black October." The name may sound dramatic, but the developments behind it deserve attention. And while many attacks target large organizations, the consequences can eventually reach your personal accounts. Here's what's happening, how AI-powered cyberattacks are changing online security and what you can do to protect yourself.

Join our upcoming CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money

In this free live online class, Kurt "CyberGuy" Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season. You’ll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.

Join us Saturday, October 31, at 11 AM ET / 8 AM PT. Register free now at CyberGuyLive.com.

BILL GATES SOUNDS ALARM ON AI-POWERED CYBERATTACKS, WARNS OF 'NEGATIVE SURPRISES' WITHIN A YEAR

Why cybersecurity experts are calling it Black October

October 2026 has delivered a troubling wave of cybersecurity developments. Hackers have gained access to more powerful tools, while researchers have uncovered serious weaknesses in widely used software. Security professionals are reportedly struggling to keep pace with increasingly automated attacks. Some have started calling the current wave "Black October."

The term describes a series of cybersecurity emergencies rather than a single coordinated hacking campaign. The biggest concern is speed. Traditionally, hackers needed significant time and technical expertise to investigate potential targets. They also had to develop attack methods and analyze the information they obtained. Now, AI tools can automate portions of that work. Some can operate continuously and pursue multiple potential targets at once. As a result, companies may have less time to respond when criminals discover a way into their systems.

Microsoft exposes AI cyberattacks moving at machine speed

One of the clearest examples comes from Microsoft. On Oct. 21, Microsoft Threat Intelligence revealed that a China-state-aligned hacking group called Storm-0940 had used an AI-powered penetration testing framework called ARTEX. The open-source tool can automate security testing tasks, including investigating networks and identifying potential weaknesses. In the hands of criminals, those capabilities can accelerate attempts to gain unauthorized access.

According to Microsoft, the group used ARTEX to target hundreds of organizations across multiple industries. Several attacks resulted in unauthorized privileged access to cloud systems. In multiple cases, attackers reached that level of access in less than three hours. Although many attempts failed, the successful intrusions demonstrate how quickly AI-assisted attacks can unfold.

Hackers launch thousands of login attempts per minute

Between Oct. 10 and 14, Microsoft recorded more than 151,000 failed login attempts in one campaign targeting 327 accounts across eight organizations. At its peak on Oct. 11, attackers generated approximately 2,900 failed login attempts per minute. The technique, known as password spraying, involves trying passwords against multiple accounts to identify a working login.

Importantly, Microsoft did not observe successful logins during that specific campaign. However, it documented unauthorized access and suspicious activity in other environments associated with the same threat group. Microsoft also connected Storm-0940 to a compromise involving ConnectWise, a company that provides software used by IT service providers. Attackers exploited access associated with ConnectWise cloud applications to attempt entry into customer environments. Some then carried out further activity through Microsoft cloud services, including changes that could help them maintain access.

Microsoft cautioned that suspicious access does not automatically mean customer information was stolen. Nevertheless, the activity reveals how AI can help attackers move quickly once they obtain usable credentials.

A $449 AI account scare shows the financial danger

The risks become more personal when you look at what happened to Colin Parsons. Parsons reportedly woke up to roughly 50 notifications about charges involving OpenAI and Anthropic. He reported $281 in unexpected OpenAI usage and another $168 involving Anthropic. Both credentials were associated with OpenCode, an AI coding platform he used.

On Oct. 17, OpenCode disclosed a security incident involving its Console service. The company said unauthorized access to a legacy system may have exposed third-party AI provider keys stored by some users. The company reportedly notified affected customers and advised them to revoke their credentials.

OpenCode said the incident affected approximately 1.4% of its Console users who had connected external AI providers. The disclosure concerned credentials stored in Console, rather than keys stored locally in OpenCode's desktop or command-line applications. Other users also reported unexpected charges, although the amounts have not been independently verified. OpenCode associated its incident with a large-scale AI model distillation attack, but it has not publicly established exactly how the reported unauthorized usage occurred.

The concern is straightforward. If someone obtains a working API key, they may be able to use a paid AI service and generate charges against the account owner's billing arrangement. For people who depend on AI tools for work, that can become expensive before they realize anything has happened.

WINDOWS MALWARE USES GROK AI TO HELP STAY HIDDEN, RESEARCHERS SAY

A massive website security scare adds to Black October fears

While hackers are becoming more capable, AI-assisted security research is also uncovering dangerous weaknesses in software that supports the internet. On Oct. 21, developers released emergency fixes for two critical vulnerabilities in PHP, a programming language widely used to operate websites.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are collectively known as PHP2Shell. Under certain conditions, the flaws could allow attackers to execute malicious code on vulnerable servers without first signing in. Successful exploitation could expose sensitive information or give criminals control over affected systems.

The potential impact is enormous because PHP powers roughly 70% of websites whose server-side programming language is known. However, that does not mean 70% of websites were hacked. It also doesn't establish that attackers could successfully compromise every website using PHP. The vulnerabilities affect PHP installations handling web requests, but successfully exploiting them can require complex technical conditions.

Federal agencies issue urgent security warnings

The situation prompted warnings from U.S. cybersecurity authorities. On Oct. 23, the FBI issued a public alert urging organizations to patch affected systems immediately. The Cybersecurity and Infrastructure Security Agency also called for urgent updates. The PHP project released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Website administrators running older unsupported versions need to obtain appropriate vendor-supported fixes or migrate to a supported release.

Meanwhile, several government organizations in Europe temporarily took websites offline as a precaution. However, the situation became clearer as researchers investigated. On Oct. 23, the Netherlands' National Cyber Security Centre said exploiting the vulnerabilities appeared more complicated than initially feared. The agency lowered its assessment of the likelihood of widespread exploitation.

Also on Oct. 23, PHP disclosed a separate vulnerability, CVE-2026-115560, involving an unusual combination of server settings and application code. The project recommended a temporary configuration change while it prepares a fix through its regular release process. Website owners should continue following official PHP security guidance rather than assuming the emergency has completely passed.

Cybersecurity firm CrowdStrike also reported seeing attempted attacks, but said it had not observed successful exploitation of PHP2Shell in its investigations at that point. Other security researchers, including Amazon Threat Intelligence, observed suspicious exploitation attempts beginning before the patches became publicly available. Those attempts remain important even without proof that they successfully compromised real systems.

However, new evidence emerged over the following days. On Oct. 24, security researcher Adel Karimi documented successful PHP2Shell exploitation against specially configured test servers, known as honeypots. The attacks launched 35 command shells across three honeypots. Although those findings did not establish how many real-world websites had been compromised, they demonstrated that attackers could successfully exploit the vulnerability under certain conditions.

Then, on Oct. 26, CISA added both PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog. The designation confirms that federal authorities recognize evidence of active exploitation. It also reinforces the urgency of installing security updates, even though the full extent of attacks against real-world systems remains unclear.

AI is helping hackers, but security researchers are using it too

There's another side to this story that deserves attention. Artificial intelligence helped researchers investigate the PHP vulnerabilities before the October emergency. According to the PHP Foundation, developers had identified early signs of one underlying problem during a security investigation in 2024. However, the team struggled to develop a reliable solution. Additional research in 2026 exposed the seriousness of the issue.

The foundation worked with researchers and used AI-assisted security tools, including technology from Anthropic and OpenAI, to examine PHP's code. Researchers from security companies Calif and Wiz also contributed important findings. The PHP Foundation says these reports helped clarify the vulnerabilities' potential impact and accelerated the work needed to release fixes.

AI can therefore help defenders identify dangerous weaknesses before criminals exploit them. The challenge is ensuring security teams can investigate the findings and distribute fixes quickly enough. That challenge is becoming more urgent.

What AI-powered cyberattacks mean for your personal information

You may be wondering how any of this affects you if you're simply checking email or shopping online. The concern starts with the companies holding your information. When hackers compromise a business, they may gain access to stored customer information. Depending on the systems involved, that could include email addresses or passwords. Financial details may also be exposed. Criminals can use stolen information to launch convincing scams or attempt to take over existing accounts.

Meanwhile, AI makes it easier to produce personalized phishing messages. Attackers can incorporate leaked information into emails that appear to come from a company you recognize. Some criminals also use AI-generated voices to impersonate people and pressure their targets into making payments.

However, a security vulnerability affecting a website doesn't automatically mean your personal information has been exposed. The actual risk depends on whether attackers successfully gained access and what information they obtained. That's why it helps to focus on the steps you can control.

HACKERS HIDE DANGEROUS FAKE AI DOWNLOADS BEHIND GOOGLE ADS

8 ways to protect yourself from AI-powered cyberattacks

You can't personally fix security problems affecting large companies. However, you can strengthen your accounts and reduce the potential damage if criminals obtain your information. Here are seven precautions I recommend taking now.

1. Secure your most important accounts first

Start with your primary email account. Criminals who gain access to it may be able to reset passwords for other services you use. Create a strong, unique password for every account. A reputable password manager can help you generate and store those passwords. Next, enable multifactor authentication wherever it's available. Passkeys and hardware security keys offer especially strong protection against phishing. Authenticator apps are another useful option. Avoid relying on passwords alone.

2. Check whether your passwords have been compromised

Your phone may already have tools that can identify passwords exposed in known data breaches. On an iPhone, open the Passwords app and review its Security section. Android users who save passwords through Google can review warnings in Google Password Manager. If a password has been exposed, change it directly through the company's official website or app. Also update any other accounts using that same password. Our article explains how to find compromised passwords on iPhone and Android. Remember, a compromised-password warning does not necessarily mean someone has accessed your account. However, it gives you a chance to replace a vulnerable login.

3. Watch your accounts for suspicious activity

Enable transaction notifications through your bank and credit card providers. Also review recent sign-ins on your email accounts and other important services. Watch for unfamiliar devices or changes to your recovery information. If you spot unauthorized activity, contact the provider through its official website or app. Change affected credentials and revoke unfamiliar sessions where possible. Don't wait for several suspicious charges before investigating.

4. Review which apps can access your information

Many people connect third-party apps to their Google or Microsoft accounts without thinking about the permissions they're granting. Over time, those connections can accumulate. Some applications may retain access even after you've stopped using them. Open your account's security settings and review connected applications. Remove access you no longer need or recognize. However, if a service you use has announced a security incident, follow its specific recovery instructions. Simply disconnecting an app may not revoke credentials that attackers already obtained.

5. Use strong security protection and monitor your identity

Strong antivirus software can help detect malicious downloads and block dangerous websites. However, antivirus protection cannot prevent every account takeover or stop a company from experiencing a data breach. That's why monitoring your financial information is also important. Consider placing a free credit freeze with Equifax, Experian and TransUnion to help prevent criminals from opening new credit accounts in your name. Keep in mind that a freeze won't protect accounts you already have. If you use AI services that require API keys, review your usage regularly. Revoke credentials that may have been exposed and set billing alerts or limits where the provider supports them. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.

6. Consider using a personal data removal service

Data brokers collect and sell personal information, including phone numbers and home addresses. Criminals can use those details to make AI-generated scams more convincing. A personal data removal service can help remove your information from people-search sites and data broker databases, making it harder for scammers to find. However, it can't erase information from past breaches or prevent cyberattacks. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.

7. Keep your devices and software updated

Enable automatic security updates on your phone and computer. Keep your browser current, too. Updates frequently fix vulnerabilities that criminals may try to exploit.

8. Be skeptical of urgent security messages

AI-generated phishing messages can look remarkably convincing. They may contain personal information that makes them appear legitimate. Be cautious if someone unexpectedly claims your account has been compromised or demands immediate payment. Instead of clicking a link, open the company's official app or visit its website directly. Never share a verification code with someone who contacts you unexpectedly. Criminals often create pressure because they want you to act before checking the details.

Kurt's key takeaways

What concerns me most about this wave of AI-powered cyberattacks is the speed. Microsoft documented attackers gaining privileged access in less than three hours. That's a frighteningly short window for companies to react. At the same time, AI is helping security researchers uncover weaknesses before criminals exploit them. But here's what worries me. We trust companies with enormous amounts of personal information, yet we're often left dealing with the fallout when their security fails. I believe those companies need to be held more accountable. Until then, protecting our accounts and staying alert to suspicious activity remains our best defense.

If AI allows hackers to attack thousands of accounts in minutes, should companies face tougher penalties when they fail to protect our personal information? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Newsletter

• Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
• For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
• Plus, you'll get instant access to my Ultimate Scam Survival Guide free when you join.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Copyright 2026 CyberGuy.com. All rights reserved.

The race for artificial intelligence (AI), or superintelligence, will be won not just by technology companies, but by the nation that can deliver reliable, affordable and secure electricity. America is in a high-stakes sprint to lead the world in AI. This technology will reshape our economy, strengthen national defense, transform manufacturing and determine which nations lead the next generation of innovation.

But Washington and Silicon Valley cannot afford to ignore a glaring bottleneck: AI runs on electricity. America must dramatically expand its power generation and delivery infrastructure if it hopes to remain the global technology leader.

Data centers are the backbone of this revolution. They require enormous amounts of electricity, reliable grid connections and specialized infrastructure. Without sufficient power, advanced AI systems are little more than expensive hardware waiting for a connection. This creates an immense opportunity for America’s electric utilities. For too long, utilities have been viewed simply as service providers. Today, they are strategic partners in America’s economic competitiveness and national security.

THE AI REVOLUTION WILL GO WHEREVER THERE'S ELECTRICITY — AND CHINA KNOWS IT

To win the AI race, America must unleash domestic energy production, accelerate infrastructure development, defend against cyber threats and ensure that the private sector — not residential ratepayers — finances this expansion. This is a crucial opportunity for the administration, Congress, state governments and the private sector to coordinate an energy strategy that prioritizes American competitiveness.

Let the private sector finance growth

Electric utilities possess the engineering expertise and operational experience necessary to support data center expansion. They understand regional demand, transmission constraints and the complex mechanics of grid reliability. However, building the necessary infrastructure takes time; new generation facilities, transmission lines and substations often require years of planning, permitting and construction.

FIRST DATA CENTER BILL CLEARS HOUSE AS BOTH PARTIES SCRAMBLE FOR ANSWERS ON AFFORDABILITY

Data center developers, meanwhile, want to move quickly to capitalize on the AI boom. To bridge this gap, utilities and developers must collaborate much earlier in the process, aligning construction schedules, forecasting demand and identifying necessary upfront investments. Washington can support this by streamlining permitting and reducing regulatory delays to provide long-term investment certainty.

Crucially, data center developers must bear their fair share of the infrastructure costs driven by their massive electricity demands. Residential customers and small businesses should not subsidize infrastructure built primarily to serve trillion-dollar technology companies. Long-term power purchase agreements, dedicated infrastructure investments and minimum billing commitments can ensure large customers contribute appropriately. This is an argument for responsible, pro-business growth where financial risks are not shifted onto ordinary Americans.

The White House’s Ratepayer Protection Pledge reinforces the principle that America can accelerate AI innovation without forcing ordinary Americans to subsidize Big Tech’s infrastructure demands. Electric utilities can benefit from increased electricity sales, long-term power contracts and investments in generation and grid infrastructure, provided data center developers pay their fair share of the costs.

DATA CENTERS COULD BE THE SLEEPER ISSUE OF THE 2026 MIDTERM ELECTIONS

To protect consumers, we must require transparent cost allocation, enforceable commitments from large data center customers and safeguards preventing residential ratepayers from being left with stranded infrastructure costs if projects are delayed, scaled back or abandoned.

Energy dominance requires real abundance

America cannot achieve energy dominance if it cannot generate enough electricity to power its expanding economy. Meeting this challenge requires an "all-of-the-above" strategy that evaluates energy resources strictly based on reliability, affordability and availability.

TRUMP ENERGY DEPARTMENT ISSUES EMERGENCY ORDER TO PREVENT BLACKOUTS ACROSS 13 STATES AMID UNUSUAL OCTOBER HEAT

Natural gas provides essential dispatchable generation, while nuclear energy offers dependable baseline power with low operational emissions. Hydroelectric power, wind, solar and battery storage all contribute where they make economic sense. Existing coal facilities also remain part of the equation where continued operation is economic and legally compliant.

No single technology can solve every regional power challenge. Utilities need the flexibility to select the optimal resource mix for their customers. The objective is straightforward: build enough reliable generation and transmission capacity to meet rising demand without spiking energy prices. This is vital as data centers increasingly compete for power with manufacturers, hospitals, military bases and households. Energy abundance is a national security imperative.

Securing the grid from cyber threats

There is another critical threat that deserves far more attention: cybersecurity. The electric grid and digital infrastructure are deeply interconnected. Power disruptions halt essential computing services, while software incidents at technology providers can ripple back to affect critical infrastructure. Foreign adversaries and sophisticated cybercriminals understand these critical dependencies.

Electric utilities operate vital infrastructure that must withstand attacks against corporate networks, industrial control systems and substations. Concurrently, data centers face distinct risks involving cloud platforms, software supply chains and third-party vendor access. These are interconnected risks that could have significant national security consequences.

AN AI CYBERATTACK COULD TURN OFF AMERICA'S LIGHTS BEFORE WASHINGTON EVEN UNDERSTANDS WHY

Utilities and data center operators must establish joint incident response plans, conduct realistic multisector exercises and develop secure mechanisms for sharing threat intelligence. Organizations should strengthen network segmentation, multifactor authentication and vulnerability management. In particular, utilities must ensure that a compromise of ordinary corporate IT does not provide a path into operational technology controlling the grid. A stolen password should never become a gateway to disabling the power supply.

Supply-chain security deserves equal focus. Hardware, software and remote maintenance arrangements can introduce vulnerabilities into both utility operations and data center environments. Companies must rigorously assess critical vendors and establish clear protocols for addressing compromised components.

CLICK HERE FOR MORE FOX NEWS OPINION

While the federal government has an important role in providing actionable threat intelligence, cybersecurity must not become an excuse for expensive, rigid mandates. Security frameworks should remain risk-based, practical and focused on resilience.

Data centers as grid assets

The relationship between utilities and data centers should not be one-way. With the right investments, large computing facilities can help improve grid flexibility. Some AI training workloads can be shifted to off-peak hours, allowing operators to reduce consumption during periods of high demand.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Furthermore, battery storage and appropriately designed onsite generation can provide grid stability during emergencies, turning data centers into strategic assets that strengthen, rather than strain, America's energy future.