October 2026 is being called the worst month in cybersecurity history and has already been dubbed “Black October.”

PHP, a programming language that runs ~70% of websites, revealed a critical vulnerability that could allow attackers to take control of servers and the databases behind them.

Node.js, one of the most common engines running the server side of the internet (think Netflix, PayPal, and LinkedIn), revealed several vulnerabilities. The most serious has to do with Brotli (a compression tool built into nearly every browser), which could have allowed external attackers to remotely control servers. Other tools like LiteLLM (a middleman that routes requests to AI models) and GitLab (where companies store their source code) revealed significant vulnerabilities or hacks… to name just a few.

THE SITUATION

The situation is serious enough for the US National Security Agency and UK National Cyber Security Centre to publish urgent warnings and for government websites around the world to be taken down as a precaution.

The CEO of Cloudflare, a global cloud infrastructure and cybersecurity company, noted that the fallout was only just beginning. In his words, “The next two years are going to be incredibly fraught with new tools that have infinite patience to go look for vulnerabilities across the internet… it’s going to feel like the sky is falling.” Cognition CISO Alex Stamos noted on the Big Technology podcast that cybersecurity companies are already so backlogged with urgent fixes and patches from current clients that there is no capacity for immediately responsive help.

The temptation is to read all of this as a technology story, a bad month to be patched and forgotten. And it is a technology story. But there is also a transcendent political component to this, because Black October is the bill coming due on the digitalization of our lives. At stake in this assault on the digital realm is the sovereignty of the state and the privacy of the individual, and it is not clear that we can save one without sacrificing the other.

Revelation

A word about what Black October isn’t. This is not the Cylons taking over. AI agents are not hacking with reckless abandon or agency. The PHP vulnerability, for example, was discovered in August as part of OpenAI’s Patch the Planet project, whose stated goal is “to not only identify vulnerabilities, but help patch them.” These are existing vulnerabilities that humans are using AI to find and fix. Stamos offered an incredible metaphor for this: Being on the internet was always like walking down a bad neighborhood in Los Angeles… but now it’s like trying to walk in a bad neighborhood in 1993 Mogadishu #blackhawkdown.

Nor is this state-sponsored hacking at scale, though the PHP vulnerability’s premature disclosure did expose countless websites, and hackers everywhere—state-directed or mercenary—now have powerful AI tools at their disposal.

Still, Black October was not an attack so much as a revelation about how vulnerable we have always been online.

The End As We Know It

Black October is, as Ben Thompson declared earlier this week, the end of the internet as we know it. For decades, the internet has been a sort of global commons, an expression of techno-optimism, an a-ideological meeting space where anyone could say anything and maintain anonymity or even privacy.

The digital world vanquished the analog world in short order, as individuals and governments alike moved massive and irresponsible amounts of data online because it was quicker and more efficient. Our communications have moved from landlines and paper to 5G networks and emails. Our banking systems are online and connected to our phone via apps. Our power grids, wastewater systems, and pipelines are software-controlled and network-connected and critically vulnerable. Even systems that are supposed to be isolated will likely be at risk of breaches as connected devices, and the AI riding on them, spread from networks to toasters to smart watches.

There has always been a line between the internet we all know and love and the so-called “dark web,” a part of the internet that requires specific software and network configurations to access, not to mention malicious intent. The dark web is a realm of fraud, ransomware, pornography, and black markets, a place where one could obscure one’s identity and location to do illegal things. The real web is the dark web now.

A Monopoly on Data

It is not hard to see why this is not just an individual issue but a geopolitical one. States exist because they are sovereign, and to paraphrase Max Weber, sovereignty is when the government has a monopoly on the legitimate use of force within a state’s borders. Not just our personal lives but the infrastructure upon which the state depends, even the systems and tools and weapons of coercion and violence that governments have at their disposal to preserve and enforce the rule of law, now live on the internet.

So, we must extend Weber: Sovereignty also means a monopoly on the control of data within a state’s borders. AI models gift capabilities to everyone from individual hackers to state-backed hacking pools to disrupt or control critical infrastructure and defense. The state enjoyed the freedom of the internet as much as we did, but now the state must control the internet, or else move its critical capabilities and information into a protected sphere that cannot be breached by a bored Russian hacker in his grandmother’s basement on a random Tuesday.

The Digital Bukele

Leave the internet anarchic and anyone with a laptop and a grudge can turn off the water. That’s clearly unacceptable. But the cure for anarchy is order, and the cure can be worse than the disease. Consider El Salvador, which had one of the highest homicide rates in the world until Nayib Bukele came to power. Bukele dispensed with things like the rule of law, and even with basic tenets of democracy. The result was tens of thousands of alleged gang members thrown in prison, repression of expression and individualized freedom… and a far safer environment for Salvadorans in which to live.

Online, order means the state will try to see and control everything to make its monopoly on data as complete as its monopoly on force. And a state that sees everything is the end of the private person. In other words, the remedy for the sovereignty crisis is the privacy crisis. When the digital Bukele arrives promising to make the streets safe (and he will), who is he? The state? Elon? Amazon? And what are we handing them in exchange for the safety?

The last of our privacy, that’s what. The internet has functioned as a global commons and a place of unparalleled openness, but it was still relatively anonymized, and one could ultimately decide what they chose to disclose. It functioned simultaneously as a space for human interaction but also a space for privacy or, at least, pursuing private interests. Your friends and family didn’t know what you were doing on the web, what videos you were watching, what surprise gifts you were buying, which chatrooms or subreddits you frequented. Now, any data that is online should be assumed to be public knowledge. Data is now only private to the extent that it is offline.

Relearn, Reclaim

The wealthy can afford to buy privacy in this world—private jets and off-grid properties effectively “air-gapped” lives. But what can the normal person do? Build walled-garden apps for their families with the same AI tools that are compromising every facet of their life, from their bank accounts to the apps that keep them updated about how their daughters are doing at daycare?

Hannah Arendt argued in The Human Condition that a healthy public realm requires the existence of a private one: “A life spent entirely in public, in the presence of others, becomes, as we would say, shallow.” Without the private realm, what remains is a society of pure administration, ruled by an “invisible hand, namely, by nobody,” which Marx thought would lead to freedom, and which Arendt watched lead to the totalitarian horrors of the 20^th century.

The thing likeliest to undo us isn’t a superintelligence farming us like batteries in The Matrix, or even a Tyrell-like corporation reaching for power. It’s quieter: what Tony Judt called the will to ignorance, the unwillingness (inability?) to understand what is at stake. We will soon be asked to trade our privacy for safety in the same way we’ve already traded our attention for convenience, and the temptation is to take the deal without considering the consequences.

Privacy has become a skill we let atrophy because, for 30 years, the internet did the remembering and the knowing for us more easily than we could ourselves. So yes, change your passwords and set codewords with your family to foil the inevitable scammers, who are no doubt coming after the treasure trove of data they just harvested before Black October’s vulnerabilities were patched.

But the more pressing work is to relearn privacy and reclaim it, not just for our own sakes but for our societies’, because a people with no private life left is the shallow, administrable public that forfeits its liberty long before realizing it has already gone.

MAP/CHART OF THE WEEK

BLIND SPOT

We got three elections this week: a surprise Lula comeback in Brazil, a Vucic defeat in Serbia, and Israel. Let’s briefly address them all.

Brazil

A few weeks ago, I devoted an entire article to Brazil’s future after Flávio Bolsonaro’s surprisingly strong showing in the first round of Brazil’s elections. Bolsonaro fumbled badly in the weeks since, declining to release details about precisely how he would reckon with Brazil’s debt and inflation problems and denigrating Lula’s past as a blue-collar metal worker. These missteps backfired on him, and now Lula gets a fourth term.

Inflation and debt are pressing and immediate problems Lula must address, and if he’s to make progress, he will have to do so by compromising with Bolsonaro’s right-wing Liberal Party (PL), which already won pluralities in the Brazilian Senate and Chamber of Deputies earlier this month.

Brazilian markets sold off sharply on the news, but whether one is bullish or bearish on Brazil should have little to do with who is president. Brazil is a dynamic economy with abundant sources of commodity and agricultural wealth. These parts of Brazil’s economy will do well in almost any political circumstance. And the real bull case is one in which Lula and the PL both compromise to achieve fixes for the structural problems that have held Brazil back for decades.

Asking an old ideologue like Lula to change his stripes is a tough ask, and Flávio Bolsonaro obviously thinks it is impossible. How else to explain his shocking, reported escape to the United States after Brazilian authorities demanded his passport as part of an investigation into a money-laundering case?

Serbia

Aleksandar Vučić was Europe’s longest-serving leader outside the former Soviet Union until his election concession over the weekend. His top-down economic record is a good one: Since coming to power in 2012, nominal GDP almost tripled, FDI hit record highs, infrastructure was built, and unemployment is down almost 70%. Vučić also earned criticism for limiting press freedoms and the independence of the judiciary, which have stalled Serbia’s application to the EU.

But as with Viktor Orbán in Hungary, for all Vučić’s critics, Serbia just saw a peaceful transfer of power, as young Serbians, tired of the incumbent and disillusioned with their own prospects, cared less about the government’s past performance. That will ultimately be Vučić’s legacy—a controversial figure who peacefully stepped back when he lost an election. Now a new generation of Serbians have a chance to choose new policies… and the EU has an opening to forge better ties with Serbia, if it can put aside the ideologies of the past and meet Serbia where it is at, and not where it decides it should be.

Israel

The election is over… so now the real election can begin. The results were not conclusive, as Netanyahu’s Likud Party claimed the most seats, but his far-right religious coalition does not have a clear path to a majority. Neither does the Netanyahu opposition, unless it is willing to do something that has only been done once (and briefly) before in Israeli history and make a coalition with Arab parties, which according to exit polls secured 18 seats. That’s a record high for Arab parties but also reflects Israel’s demographics.

The math is clear: The Netanyahu opposition can work with Arab parties, or it can stick with only Jewish parties and remain in opposition. The math is also not kind for Netanyahu’s bloc, and it’s unclear how he can expand his share, which means we could be headed toward another round of elections or an unstable minority government… or the kind of political surprise that only a survivor like Netanyahu could engineer. 

READER QUESTION

FINALLY...

What I’m watching: War, HBO

What I’m reading: The Human Condition, Hannah Arendt

What I’m listening to: I started a new podcast project with one of my favorite tech analysts, Dror Poleg. Take a listen!