Facebook 
Twitter 
Some people online are calling this week “Black October.”
In the past 3 days, the internet has seen some of the biggest security holes in years.
And I think the biggest threat to your money hasn’t even shown up yet.
Here’s the company I’m buying to protect against what comes next.
It all started with a piece of software called PHP.
Most people have never heard of it…
But it runs behind about 70% of the websites on the internet.
On Wednesday, PHP rushed out a fix for two critical holes.
Both let a hacker anywhere in the world take over a website’s server without a password.
And both are rated 9.2 out of 10 for severity.
Anything 9 or higher is labeled “critical,” which is the worst rating there is.
Hackers moved incredibly fast.
Cloudflare CEO Matthew Prince said his network saw thousands of attempts to exploit the flaw in the 10 hours before it was even announced.
Two hours after the announcement, that number hit hundreds of thousands, and it was in the millions by Thursday.
It got so bad that governments started taking their own websites offline!
In Britain, 32 government services went offline.
The Netherlands’ national cybersecurity agency took its own website down.
Japan’s prime minister posted a late-night message that said…
“We have an urgent request for everyone to take action tonight.”
And big Japanese banks like Mizuho shut down online services.
Bangladesh’s central bank took its website offline too. Its spokesperson warned that “central banks around the world are being targeted by hackers.”
And PHP was just one of many major cybersecurity incidents this week:
- GitLab, a popular tool programmers use to store their code, disclosed a 10-out-of-10 severity hole in versions going back to 2014
- Hackers slipped password-stealing code into LiteLLM, a popular AI tool
- Railway, a cloud company used by developers, said hackers may have accessed some customers’ secret keys
- Video game maker Capcom confirmed that 11.7 million email records were exposed
- State Bank of India, the country’s biggest bank, confirmed customer records showed up on the dark web
The PHP holes had been hiding for more than a decade. Artificial intelligence helped find them.
Researchers at Wiz said “frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”
OpenAI co-founder Greg Brockman says “we’re entering a new phase of cybersecurity.”
Defenders found these holes first and rushed out fixes…
But that hasn’t stopped hackers.
Amazon’s security chief says the PHP hole “is now being broadly exploited in the wild.”
There’s another story most people missed, and it goes right to the heart of how your money is protected.
An Indian company called eMudhra issues the digital certificates that prove websites are real. Researchers found that eight of its secret keys were so weak that anyone could guess them in 256 tries. One of them was literally the number 4.
Mozilla, Google and Apple blocked them. On Thursday, eMudhra said it would quit that business.
That’s what happens when the locks protecting the internet fail.
Q-Day is the day a quantum computer becomes powerful enough to break the encryption that guards bank accounts and government secrets.
This would be DRAMATICALLY worse than what we saw this week.
When it comes, even strong keys could end up as useless as eMudhra’s.
That’s why I’m investing my own money in a private quantum security company that’s getting ready to list on the Nasdaq.
U.S. investors can get in for less than $5 a share.
Frankly, I think Black October is just a warning shot.
I expect cybersecurity incidents to get much worse, first because of AI and then because of quantum breakthroughs.
That’s why I want to own the defense before Q-Day arrives.
Get the details on my top quantum security pick.
Ian Wyatt