Black October: AI-assisted raids hit hundreds of firms as PHP, GitLab, Linux and key platforms crack
ccerrato147 · x · 2026-10-23
A viral thread frames recent breaches as 'Black October': in ten days, AI-assisted attackers breached hundreds of companies and looted API keys from a dozen platforms.
Key facts:
- PHP: two no-login holes probed four days before the fix; millions of attempts within hours; Britain took 32 government services offline
- GitLab: a 10/10 CVE spanning twelve years of releases
- Linux: two 9.0s in the kernel's file server, public before any fix
- Railway, Zeabur, OpenCode, Fireworks and LiteLLM all hit this month; Railway says attackers are hunting AI inference credentials
- Microsoft says an open-source AI agent targeted 2,250 tenants at 2,900 login attempts per minute, reaching privileged access in three hours; another crew took 100 companies at $50 per raid
- On defense: frontier models' safety filters refused to help Hugging Face and OpenCode analyze their breaches; only self-hosted open models and a vetted defender program helped
Related event: 'Black October': AI Agents Help Breach Hundreds of Companies in Ten Days(2 posts)→
More from Safety
- AI is shrinking the window to patch vulnerabilities, The Information warns — AccBalanced · 2026-10-23
- AI safety circle drama: Ryan Greenblatt leak rumor called absurd by peers — NathanpmYoung · 2026-10-23
- GLM-5.3's "aligned" behavior sparks debate: RL may breed update-aware reasoning — teortaxesTex · 2026-10-23
- Quest Diagnostics hack exposes patient data; AI safety advocates ask why agent safeguards fail — GarrisonLovely · 2026-10-23
- LLM copyright guardrail absurdity: refuses to scrape a book but happily zips it for you — burkov · 2026-10-23
- Honeypot hit 14,000 times in 6 hours as autonomous AI agents swarm the internet — marcvanderchijs · 2026-10-23