Black October and Beyond

#AI#Cyber Security#Black October#Hacking#Vulnerabilities#InfoSec

Phew, buddy! What a month!

And this is only the beginning.

What exactly is ‘this’? Well, here, I’m referring to the accelerated emergence of AI threats in the modern digital world.

If you’re in the cyber security or engineering spaces, you’re probably already well aware of what I’m talking about - what’s recently been dubbed ‘Black October’.

What is ‘Black October’? Here’s a partial list as of today - a list that’s likely to get considerably longer in the coming days, weeks, and months:

  • PHP2Shell: a hole in PHP, the language behind roughly 70% of the websites we can measure. Governments took sites offline.
  • eMudhra: eight of the keys that prove websites are real were generated so badly that anyone could guess them in under 256 tries. One was literally the number 4.
  • California: hackers stole data on every public school student since 2023 from the state’s testing vendor, including disability status
  • Railway: hackers got at customers’ secret keys on a hosting platform with about 2 million users
  • Zeabur: 321,810 accounts breached. The company is shutting down for good on December 31.
  • LiteLLM: an AI tool downloaded about 3 million times a day shipped a release poisoned with a password stealer
  • GitLab: a 10-out-of-10 severity hole in every version since 2014
  • Cairn: a criminal pointed an open-source AI hacking tool at 1,200+ websites and broke into the sites of 100+ companies
  • Ahold Delhaize: hackers knocked the websites and online ordering for the owner of Food Lion and Stop & Shop offline
  • Onamae: malware planted on a Japanese cloud service, with up to 26,739 customer servers potentially affected
  • Signal: a bug could let the other caller keep hearing you after you hang up
  • NGINX: 3 holes rated critical by F5 in software running about 30% of websites
  • HTTP/3: booby-trapped headers crashed or choked 7 of the 10 HTTP/3 implementations tested, some with a single connection
  • Plex: hackers breaking into home media servers through a chain of bugs dubbed “Plex2Shell”
  • SafePay ransomware: CISA and the FBI warn it has hit 600+ victims across critical infrastructure sectors
  • Palo Alto: ransomware gangs breaking in through company firewall VPNs
  • Bullhorn: platform used by 10,000+ companies knocked offline
  • Medi-Cal: a billing vendor says data on 970,000+ patients was exposed
  • WordPress: hackers stole UpdraftPlus’s remote-management keys and used them to plant backdoors on websites
  • AOMEI: backup software’s update server handed out a backdoor (this past summer, only disclosed this month)
  • Meta Muse: shared chats from Meta’s AI agent exposed users’ financial and business documents
  • Tor: 333 exit relays (about 1 in 10) hijacked to intercept SSH logins
  • TiDB Cloud: database company breached, with customer account, billing, and encrypted API key data copied
  • State Bank of India: India’s biggest bank confirms a data breach
  • OVHcloud: hackers slipped a password stealer into a cloud company’s official command-line tool
  • Siemens: a hole in Siemens software being abused to run malware
  • North Korea: state hackers (Lazarus) running a new attack campaign against South Korean companies

Why is this happening?

Well, it’s multi-faceted. But I think it’s fair to broadly say “AI. AI is why this is happening.”

And just to be clear, no, AI is not some evil force hellbent on taking over civilization as we know it. Here, AI is just being used as a multi-function tool - a universal tool, possessing basically all of the knowledge needed to be an expert at anything in the digital world - that’s now being pointed at the very systems that hold the digital world together.

Can AI help you sift through mounds of unorganized receipts and financial statements to get on top of your budget? Absolutely! Can AI help you get your business’s website built and online? It sure can! Can AI also be put to work finding undiscovered vulnerabilities in software, or cracks in an institution’s security, and then exploiting those gaps at a speed and scale we haven’t seen since the advent of the computer? Yup - and it’s pretty dang good at that, too!

Don’t just take my word for it. The folks at Wiz used AI models to find PHP2Shell, and say a single researcher finished in about a week what “would previously have taken a world-class team months.” The researcher behind Plex2Shell says he leaned on AI heavily, too. In the first 22 days of October, 13,230 new vulnerabilities were published to the national vulnerability database - in all of October last year, it was 4,389. Microsoft just shipped fixes for more than 1,400 security flaws in a single Patch Tuesday, and credits AI for the volume. And with Cairn, we got to watch AI agents do the actual breaking in: roughly 1,100 attack projects, about one in ten successful.

Now, to be fair, AI isn’t the whole story. A lot of that list is old-fashioned: stolen login tokens, admin keys sitting around in plain text, keys that were generated badly. Several of these incidents started months ago and only came to light this month. And the same AI tools are in the hands of the good guys - a big chunk of this flood is defenders finding and fixing bugs faster than ever before.

But that’s kind of the point. AI has made finding holes nearly free - for everyone. Fixes are now coming out faster than most of us can install them, and that gap between “a fix exists” and “I actually installed it” is exactly where people get hurt.

So what can we do?

And this isn’t just me saying it. Here’s Jason Clinton, Deputy CISO at Anthropic, the day after PHP2Shell dropped:

As individuals, we all need to take inventory of our digital footprint and figure out what our level of exposure is. For many people, this is likely to be minimal - but for some of us, it’s potentially substantial once you count home labs, VPS hosts, internet-exposed media servers, and the sort.

For everyone

Here’s a general “at a glance” list for everyone:

  1. Turn on automatic updates - phone, computer, browser, and apps, messengers included. Signal users: make sure you’re on at least 8.27 on Android, 8.30 on iPhone and iPad, or 8.29 on desktop.
  2. Use passkeys or a security key wherever they’re offered, then an authenticator app, with text message codes as a last resort. Start with your email account, since it can reset everything else.
  3. Assume your data has already leaked. In the US, freeze your credit at Equifax, Experian, and TransUnion (it’s free), get an IRS Identity Protection PIN, sign up for breach alerts at Have I Been Pwned, and use a password manager with a unique password for every site.
  4. Keep a backup that ransomware can’t reach - offline or immutable - and actually test restoring from it. SafePay specifically goes after shadow copies and NAS backups.
  5. Be suspicious of “recovery help” that reaches out to you after a scam. The FBI warns that scammers are even using deepfaked FBI officials.
  6. California families: the state is offering 24 months of free credit and identity monitoring over the student data breach. Details are at cde.ca.gov/ets (enroll by March 19, 2027).

For the engineers

  1. Set a dependency cooldown. Poisoned packages usually get caught and pulled within hours to days - the bad LiteLLM release was gone in under two hours - so simply waiting a few days before taking new releases would have skipped it entirely. Most package managers support this now:
    • uv 0.9.17+: exclude-newer = "7 days" under [tool.uv] in pyproject.toml, or in uv.toml (I tested this one)
    • pip 26.1+: pip install --uploaded-prior-to P7D
    • npm 11.10+: min-release-age=7 in .npmrc (heads up: the npm 10 that ships with Node 22 doesn’t support it)
    • pnpm 10.16+: minimumReleaseAge: 10080 (that’s in minutes)
    • Bun: minimumReleaseAge = 604800 under [install] in bunfig.toml (that’s in seconds)
    • Yarn 4.10+: npmMinimalAgeGate: "7d"
    • Renovate: "minimumReleaseAge": "3 days". Dependabot: a cooldown block with default-days: 7 (security updates still come through right away)
  2. Commit lockfiles with hashes and install from them exactly (npm ci, uv sync --locked, pip install --require-hashes). Pin container images by digest instead of latest - LiteLLM’s latest Docker tag served up the malware.
  3. Get secrets out of your environment variables and ~/.bashrc. The LiteLLM stealer grabbed every environment variable it could find, including those of other running processes. Use a credential store, hand secrets only to the command that needs them, prefer short-lived and narrowly scoped tokens with an expiration date, and publish packages with trusted publishing (OIDC) instead of long-lived tokens.
  4. If you installed something bad, consider that machine burned. Rotate every credential it could reach, from a clean machine. Uninstalling the package undoes nothing.
  5. Patch your runtimes: Node 22.23.4, 24.22.1, or 26.12.1 (Node 20 is end-of-life and won’t get a fix), the latest PHP release on your branch (8.5.12, 8.4.27, 8.3.36, or 8.2.35), and certifi 2026.10.19 and pip 26.2.2 in every Python virtual environment - each one carries its own copy.

For self-hosters and small businesses

  1. Keep anything admin-facing off the open internet. Put a VPN, Tailscale, or a zero-trust access service in front of it.
  2. Patch internet-facing things within days, not weeks, starting with anything on CISA’s Known Exploited Vulnerabilities list. About a quarter of exploited bugs are already under attack on the day they’re disclosed.
  3. MFA everywhere, and phishing-resistant MFA (passkeys or security keys) for admin accounts.
  4. Where you can, block your servers’ outbound traffic by default and only allow what they actually need. A stealer that can’t phone home can’t hand over your secrets.
  5. If you used Railway, Zeabur, TiDB Cloud, or the OpenCode Console, rotate every secret you stored there. Now.

Let your AI help

And here’s another opportunity… this is where you can get your little AI friends to help out - just ask them! If you pay for Claude or ChatGPT, your plan very likely includes Claude Code or Codex. Once it’s installed on your computer, you can simply prompt something like:

There have been a lot of vulnerabilities exploited online recently, and I want to make sure I’m as safe as possible. Research recent events in the cyber security space - ‘Black October’ is a good place to start. Then check my system, tell me what I’m exposed to, and what I need to do. Don’t change anything without asking me first.

That last sentence matters. An AI agent with access to your machines is itself a pretty powerful key, so treat it like one: let it look first, and approve changes yourself. One of the more ironic details of Black October: LiteLLM says the GitHub tokens used to poison its release turned up in its own logs, reportedly because an AI coding assistant had included them in its responses.

Personally, I have a project that I refer to as Claude Command and Control (‘ccc’), where I always have a Claude Code session running. The project’s agent instructions tell the session that its purpose is to be the centralized command and control agent for my systems, and to keep a record of everything we discuss and discover along the way. This project and its agent sessions help me keep my digital life in sync, including keeping my various solutions up to date and helping me mitigate threats like the ones I’m discussing in this post. I’ve also given the sessions in this project SSH access to my other systems over Tailscale, so they can help me stay on top of my VPS, media server, home lab, dedicated LLM box, and the other physical devices I manage that may have some level of exposure.

In fact, while I was writing this post, that session swept every machine I own against the list above. The headline: my Plex server was more than a year behind on updates and reachable from the internet - squarely in Plex2Shell’s crosshairs. It also flagged a GitHub token I’d exported in my own ~/.bashrc, the very thing I just told you not to do. Practice what you preach, right?

And beyond

Black October won’t be the last month like this. The tools that find the holes are only getting better, and so is everyone using them. Keep your stuff patched, keep your secrets tucked away, and put your own AI to work for you before someone else’s finds you first.

Want a glimpse of where all of this could go? @Skoorbkaz asked Claude to imagine the worst case of the next couple of years, and he says it wrote, drew, scored, and built an 11-minute film entirely in code. Then he asked for the best case. Watch them back to back.

In his words: “It isn’t a utopia. It’s a choice, and it’s still on the table.”