The internet is going into a LOCKDOWN. Hundreds of millions of websites are potentially at risk from cyberattacks. Governments, banks and major platforms have already taken their websites OFFLINE. Many are already calling it “Black October.” At the centre of the shutdowns is something most of us have never heard of, but use every day. PHP, the software behind roughly 7 in 10 websites, has two critical flaws that can let hackers break in without a password. Dubbed PHP2Shell, both are rated 9.2 out of 10 for severity. Details began circulating on Oct 20. Emergency fixes arrived the next day, but attackers were already moving. Cloudflare’s CEO says hacking attempts then jumped from thousands to MILLIONS within hours. Cybersecurity agencies across several countries are telling PHP site owners the same thing: Patch it now, or take it offline. Websites have gone dark worldwide, from government portals and hospitals to banks. CrowdStrike warns these attacks leave almost no trace, so some sites may not know if they’ve been hit. Around 2.6 MILLION internet-facing servers run PHP, potentially hosting hundreds of sites each. Over 1.1 million use older versions no longer receiving official PHP updates. Older installations may need an upgrade to a supported PHP version or a fix from their software provider. And patching does not remove a backdoor an attacker may already have planted. Cloudflare also says hackers are now tweaking their attacks to try to slip past its protections. But PHP isn’t the only security story unfolding. -Japan’s Onamae suspended ALL Desktop Cloud plans after malware was found on customer servers. -India’s eMudhra had 8 website-certificate keys so weak, one was literally the number “4”. -State Bank of India confirmed 3,897 customer records on the dark web. -Criminals used AI agents to break into 400+ Latin American banks. -Capcom confirmed a breach exposing 11.7 million email addresses. -GitLab disclosed a 10/10 severity flaw in versions going back to 2014. -LiteLLM removed a malware-containing release. Railway reported possible exposure of customer secrets. None of these has a confirmed link to PHP2Shell. We’re seeing separate breaches unfold together. The true number of incidents could take months to come out. The world is still on alert. Attacks are still coming.

Factual (official, and it matches earlier reports): Schueler and his wife were detained on 14 Oct in Beşiktaş. The text says detained (gözaltı), not arrested. Istanbul police Intelligence and Financial Crimes branches carried out the operation, coordinated by the Istanbul Chief Public Prosecutor and supported by MİT, Turkey's national intelligence service. 3 more people described as his bodyguards were detained. This confirms the unofficial İHA report. Raids hit 15 addresses in Beşiktaş, Üsküdar and Sarıyer. The official seizure list: $7.15M and 160,000 TL, 6 cold wallets, 300 bags, 100 pairs of shoes, 136 pairs of glasses, 28 watches, 97 pieces of jewelry, 29 phones, 12 laptops, 11 PC cases, 19 SSDs or external drives, 46 USB sticks, 19 graphics cards, 4 rifles, 3 unlicensed pistols and 1,400 rounds. Digital materials are still being examined. It calls him a US citizen, which settles the Turkish-citizenship theories on X. It says the Red Notice is from Interpol, but it doesn't say which country requested it. It settles earlier conflicts: The watch count is 28, so the 64 watches and "53 Rolex + 11 Patek" claims from Sözcü, Sabah and Bitcoin .com are not official. The ministry's inventory has no "$4M" line, so that headline figure isn't official either. The $7.15M is the whole-operation figure. The 1,400 rounds is right, and Akşam's 400 was wrong. Fluffed or misleading: The headline and lead. They call him the suspect in a "$1 billion crypto fraud", "wanted in the US and Finland". But Interpol's record, as far as we can see, is Finnish aggravated tax fraud. The US case was a civil SEC suit dismissed in 2025, and we have no US arrest warrant. The $1B is the SEC's old allegation, and it's worded as an allegation ("iddiasıyla"). Rhetoric. The "Turkey will not be a safe haven" lines are political messaging, not facts about the case. What's left out. It names no Turkish charge, no court outcome, no formal arrest, no extradition request, and no Finnish role. It doesn't say where he is held or what happens next. Our earlier note. The "judicial proceedings continuing" line we passed on from the minister's X post isn't on this page. Only the digital-review line is. The seizure list. The long list of bags, shoes and glasses pads out the inventory. It's official, but it isn't evidence of any crime.

24 hours later and still nothing official. No statement from Turkish police, Finland, Interpol, or Richard's lawyers. No public extradition request either. Even the seizure numbers don't match. One Turkish outlet says $600K and 24 watches. Another says $4M and 64. My opinion (still speculation): the quiet is the key here. If this was a clean grab, Finland would be taking a victory lap right now. Silence usually means lawyers are talking. Under the European extradition treaty, Finland has 18 days (40 max) to file the formal request or he can be released. And if Turkey wants to make a thing out of the guns, he might not be going anywhere for a while.