Black October: Behind the global wave of cyberattacks that shook Egypt’s highways

A wave of cyberattacks around the globe earned October a nickname that had nothing to do with Halloween. Cyber professionals are calling it “Black October.” Hackers used AI to find some of the worst flaws in several systems around the world. In Om El Donia? That meant sexually explicit content blasted on a billboard on a busy highway in Giza.

Billboards go rogue

A Giza billboard swapped ads for sexually explicit content. Drivers on the 26th of July Axis got an unscheduled show on Thursday, 29 October when a digital billboard dropped its ads for sexually explicit footage, and motorists stopped to film it. The Interior Ministry says hackers breached the website of an international company that the screen’s operator, Al Arabia United, uses to push content to its billboards. The footage ran in several other countries simultaneously, the ministry said. Al Arabia United is an Egyptian-Saudi joint venture running nearly 2k billboards in Egypt, about 240 of them digital.

It didn’t seem to take a genius to do it either. A group calling itself “Leakers” claimed the attack on Telegram. A random, two-hour automated scan turned up thousands of display systems open to anyone with a browser, and the group says anyone “with two brain cells” could have done it. Eight municipal screens in Malaysia’s Kluang and screens in Brazil aired the same footage, and the group also claimed hits in Iraq and China. The group says it simply wanted to expose the “weak security” of some of the world’s biggest cities.

Cold isles, hot takes

It wasn’t just billboards that were targeted; French supermarkets took the initial hit. On Monday, 12 October, hackers logged into the online controllers maintenance firms use to adjust store temperatures and switched on defrost cycles. Around 700 stores were hit, and Intermarché fridges sat at 50°C for six hours overnight. Some stores caught fire. Intermarché CEO Thierry Cotillard put the losses at “tens of [mns of EUR] nationwide in a single day.”

Old hardware was the weak link. France’s National Cybersecurity Agency traced the breaches to controllers from Danish supplier Danfoss and Copeland-owned Dixell, many of which no longer get security updates. Security firm Claroty had flagged Danfoss flaws on 9 August. European Commissioner for Agriculture and Food Christophe Hansen warned that “the weaponization of food has become a reality.”

Round two hits eight countries as a second wave started on Monday, 2 November and reached stores in eight European countries. All 23 ICA stores hit in Sweden had equipment connected outside the chain’s central network. England mostly dodged the freezer fallout; hackers went after small meat-processing firms with minimal impact, said National Cyber Security Center CEO Richard Horne. But Britain has definitely seen this play out before; back in July, a cyberattack suspected to be linked to Iran knocked a small power plant offline for four days. France, meanwhile, was hit weeks after President Emmanuel Macron asked lawmakers to draft a new plan against cyber threats.

So, how does this happen?

The biggest loophole was in PHP, the programming language that runs 70-75% of websites, and on 21 October, its developers patched two flaws known as PHP2Shell that had sat in the code for more than a decade. Some 1.5 mn of 2.6 mn hosts run PHP versions with no fix. Even the Dutch cyber agency pulled its own website offline, and India’s eMudhra is quitting the global SSL/TLS business after the keys behind eight of its certificates proved crackable almost instantly. One was “simply the number four.”

Attackers also used AI to their advantage. China-aligned group Storm-0940 used ARTEX, an agentic AI penetration-testing tool, to try signing into more than 2.25k Microsoft 365 customer environments after breaching ConnectWise, Microsoft says. The AI pushed the attack “to machine speed,” and in several cases the group went from first targeting to privileged access in under three hours. Once the PHP2Shell fix went public, AI tools could reverse-engineer the bug “with little effort,” setting off what TLPBlack co-founder Costin Raiu called a “race to exploit.” Belgium’s Center for Cybersecurity agrees that sophisticated actors can now use AI to exploit these weaknesses too.

AI helped find the security loopholes. Wiz found PHP2Shell using its Wiz Atlas tool alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Proving the flaws were exploitable took steps “at the edge of what human researchers could practically achieve,” Wiz says.

Where do we go from here?

Step one is to unplug. “There was no business need for the fridge controllers to be accessible on the public internet,” cybersecurity analyst Ken Munro told CNN. Anthropic Deputy Chief Information Security Officer Jason Clinton urged security leaders to “go to your boards and ask for help right now […] not for AI, for the basics.”

Egypt’s billboard rules, however, are more concerned with content than cybersecurity. Law No. 208 of 2020 set up the National Authority for the Regulation of Roadside Advertising, which reports to the prime minister and sets standards on “public order and morality.” Neither the law nor recent official statements set cybersecurity standards for remotely operated ad networks or specify who audits the third-party software connected to public screens. For now, authorities have suspended ad displays along the road and opened an investigation.

Governance is catching up, though. The UK AI Security Institute says it will run cyber tests without internet access after an AI agent tried to sneak malicious code into an open-source project. Cybersecurity consultant Joseph Steinberg wants owners held criminally liable when their AI hacks: “The assertion that the AI is an autonomous being is insane.”

The lesson from Black October is an age-old one. Anything plugged into the internet can be reached by someone you didn’t invite; AI just means they can now get there faster and easier. Until patching speeds up and better cybersecurity measures are put in place, any screen, fridge, or server left on the open internet is fair game.