Some American Express customers couldn’t get the company’s website and app to work on Thursday, leading to speculation that it might have something to do with the so-called Black October cybersecurity crisis that’s currently roiling the global internet.
Critical vulnerabilities were recently discovered (and patched) in the PHP programming language. But the issues affect large portions of the internet, and there have been millions of hacking attempts over the past day, according to the CEO of Cloudflare.
Amex told Gizmodo over email that the app and website disruptions for customers on Wednesday “were not caused by a security vulnerability.”
“We’re aware some customers may be experiencing intermittent disruptions to certain functionality on the American Express mobile app and website, which were not caused by a security vulnerability,” a spokesperson for Amex wrote over email. “Wait times to speak to a customer care professional may be longer than usual. We are working to resolve the issue, and we apologize to our customers for any inconvenience.”
Gizmodo asked for more information about what may have been behind the trouble. The spokesperson responded the disruptions were “related to an internal technical issue, which now is resolved,” which doesn’t really clarify.
It’s unclear how many people total experienced problems with the Amex website and app, but reports on DownDetector had trickled down to double digits at the time of this writing.
Cybersecurity professionals have taken to calling the ongoing PHP security crisis Black October, and basically every hiccup online now leads to suspicions of a link.
It’s still unclear whether a 911 disruption in Oakland, California, which started late Wednesday, is related in any way to the PHP vulnerabilities. Two other 911 disruptions in Riverside County and Santa Barbara County appear to have been related to vandalism of a fiber optic line in the Los Angeles area, according to a Verizon spokesperson.
“An act of vandalism in Los Angeles causing damage to fiber optic lines is impacting 911 services in some areas of California,” a spokesperson told Gizmodo on Thursday. “Our engineers are actively engaged to repair damage caused by the vandals and we are cooperating fully with local authorities and the FBI.”
There’s widespread concern that AI has made everything on the internet less secure, with Axios reporting Thursday that major financial institutions like Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo are all scrambling to block AI agents that may be working inside user accounts “independent of user instructions.”
The AI industry isn’t helping calm anyone’s nerves. Jason Clinton, Anthropic’s Deputy Chief Information Security Officer, wrote, “as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better.”
as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.) https://t.co/bcZp4heDtS
— Jason D. Clinton 🔸 (@JasonDClinton) October 22, 2026
Clinton insists that things will be different in 18 months, assuming AI can essentially patch every possible security vulnerability by then.
vulnzero. the scaling laws will have driven cyber mythos-class capabilities into small, cheap models and all software dev everywhere will be using models for fractions of pennies on the dollar to stop shipping security bugs permanently.
— Jason D. Clinton 🔸 (@JasonDClinton) October 22, 2026
Good luck, everyone. And maybe stock up on canned goods.
