Weekly AI cybersecurity roundup: PHP2Shell tops millions of attack attempts, 12 incidents ranked by severity
Dan_Jeffries1 · x · 2026-10-23
Ramez Naam's "Cybersecurity & AI: This Week" infographic ranks 12 current cyber incidents by urgency and maps whether defenders or attackers surfaced each flaw, plus the role of open vs closed AI models.
- Systemic (1-2): PHP2Shell global patch emergency (millions of attempts; Gemini + GPT used in research) and ConnectWise targeting 2,250+ tenants via ARTEX attack agents.
- High (3-6): CARLIYOS attacks on LatAm banks (400+ targets; Claude, Grok, Kimi referenced), GlobalProtect VPN ransomware exploitation, Node.js code-execution flaw (10 fixes, found via OpenAI Codex Security research), SafePay ransomware (600+ victims).
- Significant (7-10): LiteLLM supply-chain credential theft, Cairn cluster (1,100+ attack projects, DeepSeek implicated), Korean financial data theft (DeepSeek/GLM + Grok/Claude), and four agentic campaigns (Claude confirmed in part).
- Lower urgency (11-12): OpenCode Console (1.4% of consoles) and OpenSSH hardening (20% less pre-login code readable; Claude in research).
Key pattern: attacker activity skews toward open models while defender research leans on closed ones; the editorial notes AI categories describe evidenced roles, not measured damage attribution.
More from Models
- Dev plans to point an abliterated local model at his smart TV to strip spyware — TheZachMueller · 2026-10-23
- Claude $200 plan delivers 45.3x API value, author denies Anthropic quota cut — RexDouglass · 2026-10-23
- User slams OpenAI's GPT-6.1 Sol: 20 hours lost, ignores human feedback — RexDouglass · 2026-10-23
- Dexmal's open-source VLA model DM0.5 lands in LeRobot, tops RoboColiseum — AdinaYakup · 2026-10-23
- Gemini tip: enable agentic video understanding for ~90% lower token usage — patloeber · 2026-10-23
- OpenAI's Tibo Sottiaux confirms a Codex reset is landing tomorrow amid quota complaints — jeppa35 · 2026-10-23