News
Black October
This week we saw a large number of platforms compromised and vulnerabilities found all due to AI.
The most notable of these was the 2 critical vulnerabilities found in PHP allowing for attacks to execute any code they want on your server without needing a username or password. It is estimated that two thirds of the internet runs on PHP, making this one of the most wide reaching vulnerabilities AI has found so far.
The hack was found by an independent researcher using GPT 5.6 Sol, and patched with the help of OpenAI and their Patch the Planet program, the first of many that we expect to see from it.
The hack was notable enough that the NSA, FBI, and Prime Minister of Japan were all tweeting about it. Within hours of its public disclosure, Cloudflare detected millions of attempts to exploit it in the wild.
Some other notable hacks include:
LiteLLM supply chain hack: malware was implanted in a version of LiteLLM, an AI gateway library, that gets downloaded 3.4 million times a day
Railway: The cloud infrastructure company was hacked, exposing all of their customers’ environment variables. Notably, LLM API keys were one of the biggest targets, due to the large black market for LLM tokens in China and Russia.
GitLab: GitHub competitor, a 10-out-of-10 severity vulnerability was found that had been there since 2014.
eMudhra: Their encryption key for their Certificate Authority service was just the number 4 (it’s supposed to be a 100+ digit long number). Probably not caused or found by AI, but will be a good tool to use to hack smart home devices for years to come.
Due to the number of cybersecurity incidents, people have started calling this month Black October. These are all powered by frontier AI models, from both the US and China, which have made bug discovery and exploitation much more feasible to do.
The CEO of Cloudflare, one of the backbones of the modern internet, has said that “we’re going to have a couple years where every single week it’s going to feel like the sky is falling”.
If you want to use AI to secure your systems, you can apply to the OpenAI Daybreak program, which reduces the guardrails on their models allowing you to use them to secure up your codebase’s defenses. You can also look at using one of the Chinese AI models like GLM 5.3 or DeepSeek V4.1 Flash, as they have far fewer guardrails preventing you from defending your systems (but this also makes it easier for hackers to use as well!).
Releases
DeepSeek V4.1 Flash 1017
DeepSeek has released an updated version of their small, fast, cost efficient Flash model. There have been battling GPT 6 Luna and Haiku 5.5 for the title as the best low cost model.
In the real world, it seems to have caught up to where Haiku and Luna are, and seems to have surpassed both of them when it comes to bug and vulnerability hunting.
Because it is an open source model as well, that means that people have been able to fine tune the already limited guardrails out of it (called abileration). This is both good for defenders, as there are no hoops to jump through or guardrails to dodge to use the model to harden your codebase, but it is also one of the main facilitators or the spike in sophisticated hacks that we have seen, often from people with little cybersecurity experience. This is an extremely doubled edge’d sword, with vast consequences to all of us that use the internet.
Finish
I hope you enjoyed the news this week. If you want to get the news every week, be sure to join our mailing list below.
