Before the internet invaded every device in our homes, and before we began carrying a combination gaming system, library, music collection, video camera, and endless scrolling machine in our pockets, Halloween was a glorious exercise in childhood imagination.

When I was in grade school, we made our own costumes. One year, I decided to become a robot.

I painted a cardboard box silver, cut holes for my arms and head, and fashioned mechanical limbs from dryer exhaust tubing. A pair of silver Freezy Freakies served as my hands. I embedded an old Speak & Spell, a speaker connected to a cassette player, and one of my father's camera flashes into the front of the box. I even wired the flash button into my glove so I could temporarily blind anyone unfortunate enough to stand in front of me.

The finishing touch was a smaller silver box for my head, complete with strategically placed eyeholes and a painted grille over my mouth. It was magnificent.

But every good robot needs a power cord. So I cut the cord off an old clothes iron and attached it to the side of my costume.

My father was considerably less impressed with this innovation. The cord ended in exposed wires inside the cardboard box, right beside my hip. I assured Dad that I would never actually plug myself into an electrical outlet. Obviously.

He pointed out that I could barely see through my robot helmet. What if some mischievous kid at the school Halloween party decided to plug me in?

I protested. My masterpiece was perfect, and I wasn't about to compromise its artistic integrity.

Dad ended the debate with his trademark declaration: “Period. Full stop. End of discussion.”

The cord came off. I would simply have to tell everyone I was battery-operated.

Looking back, my father may have saved my life. More importantly, he taught me something about parenting that has stayed with me. Children don't always recognize danger, particularly when they're having fun. Sometimes parents must make unpopular decisions because protecting their children matters more than winning an argument.

Today, the dangers are considerably more sophisticated than an exposed electrical wire. We hand our children devices that connect them to an entire world of strangers, scammers, predators, and criminals, often without appreciating what might be waiting on the other side of the screen.

And the rest of us aren't necessarily much safer. October has delivered one of the most frightening stretches of cybersecurity news in recent memory, with critical vulnerabilities, compromised systems, and unauthorized access to sensitive medical information. Artificial intelligence is accelerating the race between those who discover weaknesses and those who exploit them.

This Halloween, the things that go bump in the night may already be inside our homes, hiding in the technology we trust. Welcome to Black October.

In 1995, I graduated from Auburn University (War Eagle!), Bill Clinton occupied the White House, Windows 95 was the hottest thing in computing, and programmer Rasmus Lerdorf was developing tools to manage his personal website. He called them Personal Home Page Tools. Today, we know their descendant as PHP, a programming language that helps power a substantial portion of the internet.

More than three decades later, something terrifying emerged from the shadows. AI agents working alongside cybersecurity researchers discovered two critical vulnerabilities, collectively dubbed PHP2Shell, that could allow hackers to execute malicious code on vulnerable web servers without a password. These weaknesses could give intruders control over affected systems.

Like the opening act of a Halloween horror movie, researchers had discovered the monster lurking in the basement. They were working to lock the door before it escaped. But before the vulnerabilities could be patched, details leaked into the wild. Suddenly, defenders were racing against criminals eager to exploit the discovery.

Security teams scrambled to deploy fixes while attackers hunted for vulnerable systems. Reports of malicious scanning and exploitation attempts followed, turning an orderly disclosure into a cybersecurity version of Halloween. The defenders were racing to lock the doors while the killer was already prowling the neighborhood.

For vulnerable organizations, the consequences could be devastating: malware, stolen information, or a hidden foothold inside the network. Unlike a masked movie villain, a skilled cybercriminal or intelligence operative might remain undetected for months.

As a former FBI counterintelligence operative, I find the implications particularly disturbing. Intelligence agencies have always hunted for secret vulnerabilities, known as zero-days, that allow spies to penetrate systems and collect intelligence while victims remain blissfully unaware. The most dangerous intruder is always the one you never see.

What makes PHP2Shell especially significant is AI’s role in discovering the danger. AI agents can examine complex software and identify weaknesses at speeds that once seemed impossible. This time, AI helped the good guys find the monster. But criminals and hostile intelligence services have increasingly powerful AI tools, too.

Imagine a hostile intelligence service discovering the next critical vulnerability before defenders know it exists. No public warning. No frantic patching campaign. Attackers could quietly exploit the weakness and steal secrets long before anyone raised the alarm.

Artificial intelligence is transforming the contest between spies and spy hunters. Both sides are gaining extraordinary capabilities, and the advantage may belong to whoever discovers the weakness first. This October, responsible researchers found the monster, but premature disclosure turned containment into a race against the clock. Next time, it may escape before anyone realizes it was there.

The scariest thing about Black October isn’t what the good guys discovered. It’s what the bad guys may discover next.

1. UPDATE EVERYTHING. Computers and smartphones are obvious, but don't forget routers, home cameras, smart TVs, and even connected refrigerators. Enable automatic security updates wherever possible. If you operate a PHP-based website, ask your host or technical team whether the relevant vendor patches or mitigations have been applied.

2. TURN ON TWO-FACTOR AUTHENTICATION. Protect email, banking, financial accounts, and social media. Prefer phishing-resistant passkeys or security keys wherever available.

3. STRENGTHEN YOUR PASSWORDS. Use unique passwords stored in a reputable password manager. Move to passkeys where possible. Never recycle important passwords.

4. DON'T FALL FOR THE FAKE RESCUE. Beware urgent emails, texts, and DMs warning that you have been hit by PHP2Shell and ordering you to “CLICK HERE.” Visit the provider's official website or app independently. Sometimes the person offering to save you from the monster is the monster.

Imagine visiting your doctor, having blood drawn, and trusting that your most sensitive medical information will remain confidential. Now imagine learning that an unauthorized intruder may have accessed those records.

On October 22, Quest Diagnostics disclosed that it learned on October 21 of unauthorized access to its Quanum Lab Services Manager system, a service used in laboratory workflows. Quest said it believed certain patient records had been accessed, notified law enforcement, and was investigating.

At the time of that filing, the company had not publicly established how many patients were affected, exactly what information was involved, who was responsible, or how the intruder gained access.

Medical information is particularly personal. Depending on what is exposed, it can fuel fraud, impersonation, and targeted scams. You can replace a stolen credit card. You can change a compromised password. You cannot replace your medical history.

If you receive a breach notification, verify it through the provider's official channels, follow the specific protective guidance, and watch for anyone claiming to represent your doctor or insurer.

In another week, this might have been the cybersecurity story everyone was talking about. In Black October, it competed with an entire haunted house of digital disasters.

Last week, I delivered a cybersecurity keynote for Eye Recommend’s Regional Training Event in Toronto to an audience of more than 1,000 optometrists and eye-care professionals. We discussed espionage, cybercrime, AI, and the threats facing businesses. But when the presentation ended and the Q&A began, their biggest concern wasn't ransomware or foreign intelligence services. It was their children.

“How do I keep my kids safe online?”

Every Halloween, parents accompany young trick-or-treaters, warn them about strangers, establish boundaries, and make sure they know how to get home. Yet we routinely hand children smartphones that can connect them to strangers, manipulative algorithms, and predators who can reach them in their bedrooms.

1. Don't send them into the digital darkness too young. My recommendation is no personal smartphone until at least 14. Children who need to reach parents can use simpler devices. Sometimes protecting our children requires an unpopular decision. Period. Full stop. End of discussion.

2. Social media is a privilege, not a childhood milestone. Don't allow it just because everyone else has it. Wait until your child demonstrates the judgment and resilience to handle it.

3. Know who's knocking on their digital door. Know your children's online friends, followers, and the accounts they follow. Friendly profiles can conceal very different intentions.

4. Check the rooms you can't see. Agree on age-appropriate parental access to private chats, DMs, disappearing messages, and gaming conversations. Know that secondary or hidden (shadow) accounts may exist. Make monitoring an understood family safety rule, not a secret surveillance operation.

5. Establish boundaries before trouble begins. Set limits on screen time, social media, and nighttime use. Consider having phones charge outside bedrooms.

6. Teach them that monsters wear costumes online, too. Predators can pretend to be children; scammers can impersonate friends. AI-generated images and voices can make deception convincing. Requests for secrecy, intimate photographs, money, or personal information are warning signs.

7. Be the safest place your child can run. This is the most important rule. Children facing sextortion, bullying, or exploitation may feel trapped by shame. Criminals use that fear to isolate victims and demand compliance. Tell your children that however humiliating or frightening the situation, they can come to you. No judgment. No punishment for asking for help. Just love, protection, and solutions.

If someone threatens your child online, do not pay or negotiate with the criminal. Preserve evidence where safe and lawful, report the abuse, and seek help from law enforcement and child-protection resources. Make sure your child knows that no mistake is beyond overcoming.

When your children are trick-or-treating, you teach them that if something scares them, they should run home. Make certain they know the same rule applies online.

Whatever happens, they can always run to you.

Please support my sponsors. It only takes a click - no purchase necessary!

Mountain air, city lights or somewhere new? There's still time to make your fall plans take flight with Alaska Airlines. With hundreds of destinations, you can celebrate autumn to the fullest. See the fall foliage in Boston, sip cider in Seattle, or swap your flannel for a swimsuit and head to Hawai‘i. 

With nonstop routes to over 100 cities across North America and beyond, getting to your fall destination is easier than ever. Whether you're chasing changing leaves or year-round sunshine, Alaska’s growing network means more ways to reach where autumn is calling. 

Fares at great prices, so it's easier than ever to say ‘yes’ to a getaway before the season's gone.

Book Now

_{^{Subject to availability. Terms and conditions apply.}}

If someone forwarded you this newsletter, join more than 5,000 readers every Tuesday for practical lessons from the worlds of espionage, cybercrime, artificial intelligence, and the human stories behind them.

The monsters we feared as children usually disappeared when someone turned on the lights. The monsters lurking online require a little more effort. Stay vigilant, protect the people you love, and have a safe and happy Halloween.

Eric O'Neill

Spies, Lies & Cybercrime