Reuters reported on 5 November 2026 that companies worldwide are facing a wave of cyber threats that executives say AI is making faster and more difficult to manage. The incidents include hacked supermarket refrigeration systems, a USD 6.3 billion cryptocurrency theft at Binance and emergency work around flaws in PHP, a programming language used by many websites.
The immediate effect is operational. IT and security teams are patching overnight, taking services offline as a precaution and adding systems that use AI to scan for threats or support recovery work.
Incidents affecting operations
A cyberattack on European supermarkets in early November was the second in three weeks in which hackers raised refrigerator and freezer temperatures. Retailers had to discard spoiled food worth millions of dollars.
Marnie Wilking, chief security officer at Booking.com, described the pattern as a “never-ending game of cat and mouse” and said hundreds of engineers at the travel platform were building defence systems using AI. Markus Noga, chief technology officer of German web hosting company Ionos, said events that used to be months apart were now appearing weekly or every few days.
Ionos serves seven million customers. The company said it changed its security practices after a spike in vulnerabilities in July, adding monitoring systems that use AI to scan for threats and AI-assisted tools to install patches around the clock.
Vulnerability volume and disclosure speed
The vulnerability queue is also growing. Nearly 37,000 security flaws in software or computer systems were reported in the third quarter of 2026, three times the level a year earlier, according to the Common Vulnerabilities and Exposures list.
The refrigerator attacks show how quickly defenders may need to act after weaknesses become public. Claroty published research in August outlining weaknesses in refrigeration controllers. After attacks hit stores in France on 11 October 2026, Claroty researchers used widely available AI tools to reproduce the flaws and take control of a test device.
Sean Tufts, field chief technology officer at Claroty, said the researchers recreated the attack for USD 6 and in 28 minutes. The point for operators is that disclosure now moves quickly from advisory to exploit testing, including by people who do not need to build every step manually.
The 21 October 2026 disclosure of two AI-discovered flaws in PHP produced a similar response. Governments and companies from Tokyo to Helsinki took websites offline as a precaution. Cloudflare reported that attempts to exploit PHP flaws rose from thousands to millions within hours of disclosure.
Spending follows the workload
Companies are responding with more defensive spending. Binance said it would increase investment in AI-enhanced detection systems after hackers stole USD 6.3 billion worth of cryptocurrency. The Port of Rotterdam is working on an AI-based cyber defence project, while Siemens is testing AI models for defensive security.
Ahold Delhaize, the Dutch-based grocer that operates Stop & Shop and Giant Food in the US, was hit by two hacks in the past month. The first, in mid-October, led to more than EUR 200 million, or USD 225 million, in sales losses and prompted a profit warning. The company took its websites and apps offline for a week after detecting an intrusion.
Some Ahold stores in Belgium and Luxembourg were later among those affected by refrigeration attacks across a dozen European countries. Jolanda Poots-Bijl, the company’s chief financial officer, said smaller firms were particularly exposed, while also saying AI helped with faster detection and restoration.
McKinsey projects that the global market for cybersecurity products and services sold by outside vendors will grow from USD 223 billion in 2025 to USD 346 billion by 2029. That projection sits behind the current procurement choices: monitoring, vulnerability management, detection and response all have to cope with more reported flaws and faster attempts to exploit them.
Swiss building materials maker Holcim took its website offline around 21:30 local time, 19:30 GMT, on 21 October 2026 to install PHP fixes and restored service before midnight. Chief Financial Officer Steffen Kindler said both attackers and defenders were using AI.
When AI use shortens the time between disclosure and exploitation, the patching, monitoring and incident response choices are the questions ECS’s Security topic deals with, alongside Security Copilot, Zero Trust, Sentinel, Purview and DevSecOps. Sessions in the topic give attendees practitioner experience on monitoring, response processes and the controls that sit around Microsoft security products. Attendees should bring the vulnerability, tooling and staffing questions that are difficult to settle from product documentation alone.
This article was written by the ECS editorial team with the assistance of Amal Agent, run.events' AI assistant, which supported the research, drafting and proofreading.