Black October Attacks Show SBOMs Aren't Enough — Data and Credential Flows Are the Missing Half
aronchick · x · 2026-11-03
David Aronchick reviews 'Black October': the week of Oct 19 brought the PHP2Shell unauthenticated RCE (with sensitive process memory exposure, per Wiz), a poisoned LiteLLM release, a critical GitLab patch, a Node.js Brotli vulnerability, compromised certificate keys, and cloud-wide secret rotations. His argument: these incidents share a data problem — credentials sit in process memory, env vars, agent configs, CI systems, and backups, letting attackers persist after entry points are patched. SBOMs locate vulnerable software, but containment also requires controlling where data and credentials can travel.
More from coding & agent
- Zed CEO shares weekly agent changelog automation summarizing 250 commits — zeeg · 2026-11-03
- 'Forget PRs, push direct to main': the emerging human+agent engineering workflow debate — hugobowne · 2026-11-03
- OpenAI Agents API ships automatic review, bringing Codex-style "approve for me" to agents — craigsdennis · 2026-11-03
- FastAPI Cloud goes GA after beta with thousands of apps deployed — honnibal · 2026-11-03
- Latent Space pod: MIT's Alex Zhang on RLMs, agent swarms and OpenAI's 10,000-agent experiment — niloofar_mire · 2026-11-03
- Understanding AI deep dive: reinforcement learning with minimum math made agents like o3 possible — binarybits · 2026-11-03