Black October Hack Hits 50+ Sites, Citi, JPMorgan & Wells Fargo Restrict AI Agents

• The Black October hack took 56 websites offline after two critical PHP flaws went public, and 51 were back up by late October 22
• Citi, JPMorgan, and Wells Fargo now block third-party AI agents from logging into customer accounts or moving money
• Security firms count 200+ proof-of-concept exploits tied to Black October 2026, but nine firms report no successful attacks so far

The Black October hack is the name cyber pros gave to a wave of attacks in October 2026, led by two critical PHP bugs that knocked more than 50 websites offline on October 21. It came alongside new AI agent restrictions at Citi, JPMorgan and Wells Fargo. PHP shipped fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, so the quickest PHP vulnerability test right now is checking a server’s version. As Reuters reveals, government websites went dark as operators rushed to patch.

The PHP Vulnerability Tracker and user reports put the count at 56 sites. Cyber pros started calling this stretch Black October because so many attacks and emergency fixes landed at once. The two Black October 2026 bugs had gone unnoticed in PHP’s code for more than a decade, until AI-assisted research caught them in August.

Also Read: Aave-Linked Exploit Drains 114 ETH as Labs Urges MiCA DeFi Reforms

Black October 2026: PHP Bugs Trigger Outages and AI Agent Restrictions

What Are The Black October Bugs?

The flaws, CVE-2026-109618 and CVE-2026-109619, are behind the Black October hack and allow remote code execution without a login. As Axios reveals, attackers could steal passwords and data or take over servers. Researchers at Alphabet-owned security firm Wiz and cybersecurity company Calif found the Black October bugs with AI tools, and data from internet intelligence firm Censys shows about 1.5 million of 2.6 million hosts run PHP versions with no fix.

Tiffany Farriss, the interim chief executive of the Drupal Association, said:

“All servers using any version of PHP released in the last 20 years will be vulnerable. This issue impacts the majority of the internet.”

How The Black October Hack Spread

The embargo leaked a day early, and CERT-EU told anyone who could not patch the Black October bugs at once to pull PHP apps offline. Councils, universities, wikis and an online store went dark within hours, the first big outages of Black October 2026.

How Long Sites Stayed Dark During The Black October Hack

The Dutch data protection authority stayed offline for about 32 hours, and Nespresso’s Croatian store came back after just 15 minutes.

Which Sites Are Still Down After The Black October Hack

As the PHP2Shell outage page shows, 56 sites had gone offline by 23:12 UTC on October 22. Five were still offline, including three Japanese property portals and the BBC’s The Traitors site. Being listed does not mean a site failed a PHP vulnerability test or got hacked, and most went dark as a precaution.

Have Hackers Exploited The Black October Bugs Yet?

As NBC News shows, hackers seem to struggle with the flaws behind the Black October hack. Nine firms, including CrowdStrike and Sophos, saw no successful attack as of Thursday.

Sherrod DeGrippo, vice president of threat intelligence at Palo Alto Networks‘ Unit 42, had this to say:

“We have not yet seen these PHP vulnerabilities exploited in the wild yet.”

Also Read: Bitcoin ETFs Plunge 95.6% as Wintermute Moves $90M in BTC

Why Black October 2026 Brought AI Agent Restrictions To Banks

Axios also reported that banks have spotted unauthorized AI agents inside customer accounts, one of the problems cyber pros group under the Black October hack. The AI agent restrictions are already in place, as JPMorgan, Citi, Wells Fargo, Bank of America and Charles Schwab have restricted third-party AI agents from accessing customer accounts.

Citi said in a statement:

“To help safeguard customer accounts and information, we do not permit third-party AI agents or assistants to log into a customer’s account or transact directly within our digital banking platforms.”

Where AI Agent Restrictions Leave Trading Apps

Trading apps are moving the other way. Robinhood targets US crypto traders with 10x leverage and AI agents, adding AI-powered trading tools inside its app and offering up to 10x leverage on Bitcoin and Ethereum perpetual futures for eligible users. Banks are shutting outside agents out of accounts, and brokers are building their own agents in.

That split matters as more money flows into crypto. The AI agent restrictions also land as wealthy investors plan bigger crypto allocations, with a recent study finding institutions expect their average crypto share to rise from 11% to nearly 17% within three years. On-chain use stays busy too, as TRON averaged 4.41M daily active accounts over 30 days earlier this month. The Black October hack has turned account access into a security question for banks and brokers alike, and both now have to decide how much control to give an AI agent.

What The Black October Hack Means For Bitcoin Holders

The Black October bugs did not touch blockchains, but crypto sites on PHP still need patches. For holders, the bigger question right now is price, and Bitcoin traded near $81,488, which is the starting point for the calculator figures below.

MarketCapOf’s Crypto Profit Calculator puts a possible rebound in dollar terms. A $10,000 buy at $81,488 would grow to $10,921.85 if Bitcoin climbs back to $89,000, a profit of $921.85, or 9.22%, before any trading fees. That means Bitcoin needs a gain of just over 9% from its current price for this position to reach that level.

MarketCapOf’s ROI calculator shows how the past month played out. From September 24 to October 23, Bitcoin returned 0.97x, so $1,000 invested would now be worth $968.54, a drop of about 3%. Solana fared worse at 0.89x, turning the same $1,000 into $891.23, a loss of almost 11%.

That puts this week’s dip in proportion. Bitcoin has traded in a fairly tight band between roughly $81,000 and $86,000 over the month, and it lost far less than a major rival like Solana. ARK Invest CEO Cathie Wood also recently said Bitcoin is turning against gold as spot ETFs posted $241M in inflows.

Why Upgrading PHP Fixes The Black October Hack

The PHP2Shell tracker calls upgrading the only full fix. Admins must restart PHP afterward, and a firewall does not replace the patch, so a PHP vulnerability test only helps if an upgrade follows.

How To Run A PHP Vulnerability Test

A basic PHP vulnerability test starts with the version number. Anything below the new releases still carries the Black October bugs, and a PHP release manager said changing settings will not stop attacks. Small sites on shared hosting run the highest risk from the Black October hack, so their PHP vulnerability test often comes down to asking the host.

Also Read: Bitcoin Still 34% Below ATH After 43% Rebound. What Factors Could Drive the Next BTC Rally?

What Comes Next After Black October 2026

Experts expect the Black October hack to linger for weeks, if not longer. Hackers keep scanning for servers that missed the update, and security firms are still checking more than 200 proof-of-concept exploits. For site owners, a PHP vulnerability test and a quick upgrade come first. For everyday users, experts advise strong passwords, a password manager and no panic.

Banks face a slower fix. Liability for payments an AI agent makes is still unresolved, and regulators have privately backed the blocks, so the AI agent restrictions of Black October 2026 look set to stay for now. Read-only access remains open, with Citi still letting approved open-banking providers view account data. Crypto platforms face rule pressure too, with BNB issuer Binance facing MiCA scrutiny.