The internet is going into a LOCKDOWN. Hundreds of millions of websites are potentially at risk from cyberattacks. Governments, banks and major platforms have already taken their websites OFFLINE. Many are already calling it “Black October.” At the centre of the shutdowns is something most of us have never heard of, but use every day. PHP, the software behind roughly 7 in 10 websites, has two critical flaws that can let hackers break in without a password. Dubbed PHP2Shell, both are rated 9.2 out of 10 for severity. Details began circulating on Oct 20. Emergency fixes arrived the next day, but attackers were already moving. Cloudflare’s CEO says hacking attempts then jumped from thousands to MILLIONS within hours. Cybersecurity agencies across several countries are telling PHP site owners the same thing: Patch it now, or take it offline. Websites have gone dark worldwide, from government portals and hospitals to banks. CrowdStrike warns these attacks leave almost no trace, so some sites may not know if they’ve been hit. Around 2.6 MILLION internet-facing servers run PHP, potentially hosting hundreds of sites each. Over 1.1 million use older versions no longer receiving official PHP updates. Older installations may need an upgrade to a supported PHP version or a fix from their software provider. And patching does not remove a backdoor an attacker may already have planted. Cloudflare also says hackers are now tweaking their attacks to try to slip past its protections. But PHP isn’t the only security story unfolding. -Japan’s Onamae suspended ALL Desktop Cloud plans after malware was found on customer servers. -India’s eMudhra had 8 website-certificate keys so weak, one was literally the number “4”. -State Bank of India confirmed 3,897 customer records on the dark web. -Criminals used AI agents to break into 400+ Latin American banks. -Capcom confirmed a breach exposing 11.7 million email addresses. -GitLab disclosed a 10/10 severity flaw in versions going back to 2014. -LiteLLM removed a malware-containing release. Railway reported possible exposure of customer secrets. None of these has a confirmed link to PHP2Shell. We’re seeing separate breaches unfold together. The true number of incidents could take months to come out. The world is still on alert. Attacks are still coming.

🚨ALERT: PHP warns of ANOTHER UNPATCHED security flaw that could let hackers take control of vulnerable web servers, just TWO DAYS after releasing emergency fixes for critical PHP2Shell vulnerabilities. The NEWLY discovered flaw, CVE-2026-115560, affects websites using an uncommon technical setup. PHP has urged affected website administrators to disable a specific feature until a security fix is released. The warning comes as hacking attempts targeting the TWO earlier PHP2Shell flaws have surged into the MILLIONS, per Cloudflare. Where Things Stand: - The latest flaw affects only an unusual combination of PHP session settings. - No exploitation of the new vulnerability has been reported. - PHP recommends disabling session upload progress until its next routine bugfix release. Unlike the earlier critical flaws, PHP considers the new vulnerability an unlikely attack vector and is not issuing another emergency patch.

The world is preparing for the internet to SHUT DOWN. Yesterday, the UK government urged households to keep 3 days of food, water and cash at home. Among the risks are CYBERATTACKS that could disrupt power, internet access and card payments. And this week showed how quickly that can happen. As news of critical PHP flaws spread, attempts to exploit them climbed into the MILLIONS. Several websites gone dark while they worked to secure them. Now imagine a wider outage affecting several essential services at once. You’re buying groceries, but the checkout can’t process your card. You try withdrawing cash, but the ATM is offline. Your rent is due, but your banking app won’t load. You need medication, but the pharmacy can’t access your prescription. You arrive for surgery, but the hospital’s systems are down. You’re stranded at the airport because your airline can’t check you in. You log in for work, but your company’s systems are locked. You try calling your family, but the mobile network is down. These are ALL possible consequences of major outages. Your own phone or laptop doesn’t have to be hacked for you to feel the impact. The services you depend on just have to stop working. Prepare while everything still works.

Is GOLD really a SAFE ASSET? 🔥 A U.S. startup claims it has turned MERCURY into GOLD, that can be indistinguisable from naturally-mined GOLD. Startup Marathon Fusion says it produced stable gold at 10x CERN's record rate, raising questions about whether lab-made gold could eventually DISRUPT the TRILLION-dollar bullion market. The potential implications are HUGE: - A future 1GW fusion plant could theoretically produce around 5 tonnes of gold annually. - 100 such plants could add 500 tonnes annually, equivalent to roughly 14% of global gold mine production in 2025. - Lab-made gold would be indistinguishable from mined gold once safe for use. The breakthrough remains independently UNVERIFIED and the start up has NOT disclosed how much gold it produced or the cost of the process. If proven and commercially scalable, this could be a MAJOR technological breakthrough capable of reshaping the GOLD trade. Could MERCURY become GOLD's biggest nemesis?

⚡️ADOPTION: Singapore, Malaysia and Thailand's central banks expand cross-border STABLECOIN initiatives with Ripple, Visa and Mastercard. The move brings stablecoin settlement efforts to three Southeast Asian markets with a combined population of 111 MILLION people. Circle, Coinbase, JPMorgan and Stripe are also involved.

ALERT: U.S. spot Bitcoin ETFs recorded $635.6 MILLION in net outflows on October 22, offsetting nearly 59% of the $1.07 BILLION in inflows accumulated over the previous three days. A staggering $1.16 BILLION swing in ETF flows in just 24 hours, as $524.8 MILLION in inflows on Oct. 21 flipped to $635.6 MILLION in outflows the next day. The sharp reversal ended a three-day inflow streak, signaling renewed pressure on institutional $BTC demand amid the broader market selloff.

BREAKING: The first shipment of Russian diesel under the Trump-Putin deal is now heading to the US, officially ending a 4.5-year ban. A tanker carrying 40,000 metric tons of Russian diesel is expected to arrive in New York on Nov 7. It would be the first US import of Russian petroleum products since the 2022 ban. To allow the deal, the US Treasury issued a sanctions waiver on Russian diesel through Apr 7, 2027, while Moscow agreed to reopen exports. Trump said Russia would send an initial 300k tons to US and global markets, followed by 500k in Nov and 1M afterward. Meanwhile, US diesel prices are averaging ~$6.31/gallon, up 74% from $3.63 a year ago. The deal is part of Trump's efforts to bring down soaring diesel prices ahead of the Nov 3 US midterm elections. Brent crude is now above $115 a barrel and US crude above $100.

PHP2Shell was supposed to be a SECRET... The person who posted an early warning about the PHP flaws has apologised, saying he didn't know it was confidential. "I unknowingly broke the PHP RCE embargo. I am sorry." The plan was to announce the flaws alongside fixes, so website operators could protect their systems. But information got out early. On Oct 20, "petecooper", a freelance consultant, posted on Hacker News that two serious PHP flaws would soon be announced. He says his contact had told him there was no restriction on sharing it. "My intention was to alert others of the importance/urgency of the updates," he added. Instead, his warning disrupted the coordinated release. PHP brought its emergency updates forward to Oct 21, ahead of the planned Oct 22 announcement. But, it was too late. Videos demonstrating how to exploit the flaws have already spread online. Cloudflare reported MILLIONS of attempts to exploit the flaws within hours of disclosure. Hundreds of websites and apps have gone offline as operators responded. Petecooper returned to Hacker News, saying he never intended "any of the subsequent side effects." “I am truly sorry. I take full responsibility for my actions.”

ALERT: Silver has now lost over HALF its value in less than a year since its peak, wiping out $3,800,000,000,000.

JUST IN: Japan’s inflation is back ABOVE the BOJ’s 2% target for the first time this year. Core inflation rose to 2.1% in Sept from 1.7% in Aug, its first move above target since December last year. For context, Japan had 15 years of persistent deflation starting in the late 1990s. Annual headline inflation then exceeded 2% from 2022 to 2025, the longest streak since 1982. Higher fuel costs, a weak yen, and strong AI demand are pushing prices higher. The BOJ has already hiked 50 bps this year to 1.25%, a 31-year high. Now, markets expect one more hike before the year ends.

🇺🇸BREAKING: SK Hynix scraps U.S. subsidiary IPO plans, stock plunges -8%. The proposed Nasdaq listing could have raised about $10 BILLION for the storage-chip subsidiary, but faced shareholder opposition over dilution and splitting ownership of a business they already hold through SK Hynix. The company confirmed Solidigm is abandoning both pre-IPO financing and IPO evaluations after considering “capital market conditions and other factors.” The retreat leaves SK Hynix seeking other ways to fund Solidigm’s expansion as concerns over AI spending weigh on chip stocks.

🚨NOW: Fundstrat’s Tom Lee says "The End of the AI sell off is here" Lee argues this is a healthy correction, with debt-market scrutiny restraining speculation while AI breakthroughs continue. “I don’t think there’s too much money being thrown at AI today.” He points to easing bond yields and a potentially more dovish Fed as fading headwinds, arguing that shorting tech has become a crowded trade. Lee remains bullish on Nvidia, memory chips, the Magnificent Seven, software and crypto: “This is what I view as a coiled spring because the fundamentals have been holding in.”

🇨🇳BREAKING: Nearly ¥1.4 Trillion wiped out from Chinese stocks as Shanghai index continues to fall more than -2% to a fresh 52-WEEK LOW. The selloff is being driven by fears of overstretched AI valuations, fading hopes for fresh Chinese stimulus and surging oil prices adding to global market jitters.

🚨BREAKING: Brent crude surges above $115 to a FIVE-MONTH HIGH as renewed supply fears grip oil markets. Brent traded at $115.08 after touching $115.84, extending Thursday’s 4% rally and taking its 2026 gain above 80%. The surge comes amid reported Houthi strikes on Saudi Arabia’s Shaybah oil field, Dammam airport and Yanbu, alongside a U.S. order for non-emergency staff to leave Saudi Arabia. At least 18 vessel attacks have reportedly occurred in two weeks, with LSEG warning that Iranian targeting of tankers extends beyond Hormuz into the Gulf of Oman. The pressure is mounting on both oil production and the shipping routes that carry it.

🚨HUGE: Moderna $MRNA plunges over 17%, erasing $17 BILLION, as its cancer vaccine DISAPPOINTS. Leaked Phase 3 results showed it cut the risk of melanoma returning or death by 42%, down from 49% in its earlier trial. Even after crashing as much as 26%, Moderna is still up over 570% this year.

🩸BREAKING: Metals are MELTING, wiping an estimated $1,000,000,000,000 off gold and silver alone on Thursday. Silver sank 5.8% and gold 2.8% with surging oil fueling inflation fears ahead of next week's Fed meeting. Platinum fell 4% and palladium 3.7%, while copper slid 2.8% to a 5-week low as AI stocks sold off. Gold lost about $810 BILLION in estimated market value and silver over $190 BILLION, per CompaniesMarketCap’s supply estimates.

⚠️ALERT: Python warns unpatched apps could trust FAKE WEBSITES after 8 certificate keys were EXPOSED. Attackers could intercept connections, including to Python's own sites, python(.)org and PyPI. Each secret key was a number below 256, per Python core developer Christian Heimes, so anyone could work it out. Unpatched tools would show no warning, so a fake PyPI could hand you tampered packages. Apps could also hand passwords or API keys straight to an impostor, as a fake site "receives whatever those clients send," per security firm Endor Labs. There's no evidence the keys have been used in attacks so far, per BleepingComputer. Browsers are protected, as Chrome, Firefox, Microsoft and Apple have now blocked the affected certificates. If you use Python, here's how to stay safe: 1. Check your pip with "python -m pip --version" 2. Upgrade to pip 26.2.2 or later, using the secure command in Python's announcement 3. Upgrade certifi and uv too 4. Repeat in every virtual environment you use 5. Rebuild your Docker images with caching off, and upgrade pip inside them, as some official Docker Python images still ship an older version Updating your computer alone won't fix older pip, because it carries its own certificate list.

🇺🇸 JUST IN: Treasury OFFICIALLY proposes BANNING US investments in AI firms in China, Russia and 3 other countries. The proposal covers China, Russia, Iran, North Korea and Cuba. It mixes outright bans and notice requirements for deals in chips, quantum, supercomputing, hypersonics and biotech. Publicly traded shares are exempt, and deals under $50,000 skip the notice rule. Comments are open until December 7.

🇺🇸BREAKING: Trump OFFICIALLY invokes a national EMERGENCY to boost US oil as Brent hits $113. The President has declared US oil production "essential to the national defense." His memo cites the national energy emergency from his first day back in office. Under the memo: - Drilling, refining, pipelines, storage and marine terminals are all covered - Hegseth's Pentagon is directed to fund them through purchases, commitments and financial deals - Standard Defense Production Act requirements are waived to expand that capacity - It says industry can't expand fast enough alone due to financing, permitting and supply chain bottlenecks This is his second Defense Production Act order on oil this year, after one in April with Brent at $95.

JUST IN: OpenAI nears up to $30 BILLION at $1.25 TRILLION, LOWER than the reported $1.4 TRILLION. Last month, it was reportedly seeking at least $30 BILLION at about $1.4 TRILLION, per Bloomberg. That's still up nearly $400 BILLION from its $852 BILLION valuation in March. It's being pitched as a bridge to an IPO, which CFO Sarah Friar has told staff will likely come in 2027, per CNBC.

⚠️ALERT: ZachXBT tells users to WITHDRAW ALL funds from CoinDCX over a $16 MILLION loss it first DENIED. Its co-founder had said the wallets were "not breached" and asked people not to "spread rumours." ZachXBT claimed one of the addresses CoinDCX called old was still sending user deposits to its current hot wallet as recently as May 2026. Hours later, CoinDCX admitted a failed sweeping process on those compromised addresses led to "operational losses." It says it absorbed the losses and users' funds "remain completely safe." ZachXBT says the founders "straight up lied or are negligently incompetent." The Indian exchange was hacked for $44 MILLION in July 2025.