The news cycle by now has probably informed you of a wild threat that affects 70% of the internet.
This is true.
But what the news cycle hasn’t covered yet, was what a wild week it has been in cybersecurity.
All the things broke all at once. For some reason it all happened this week and everything hit the fan on Tuesday and Wednesday.
Some are calling Black October.
Here is what happened, with a brief description
PHP2Shell
Several critical vulnerabilities were found in PHP, a popular language that was used for building most of web 2.0, and still runs on the ever popular Wordpress which powers many websites today. An attacker can get full access to a website (shell) by exploiting this vulnerability.
Link: PHP2Shell
Some thoughts on the uncoordinated disclosure:
emudhra certs encrypted with a private key of “4”
Worse than heartbleed, 8 certificates were found with virtually no security on them allowing anyone with half a brain to intercept encrypted communications. t
The Internet goes on high alert after discovery of 8 compromised TLS certs - Ars Technica
TiDB control plane and payments info leaked (10.6 TB!)
ios zero days:
litellm pypi hijack:
railway secrets compromised:
This was a really bad incident, but surprisingly didn’t get a lot of coverage. Railway is a popular Vercel or code → deploy platform offering the ability to deploy code quickly.
It seems like the attack was a result of someone running an attack using AI from within the platform and breaking out of the container and gaining root access to other runtime instances. This is my hypothesis so far from reading the report. Until now, no new signups are available!
For almost 24 hours no new deploys were possible.
Then they disclosed it was a security incident, rotate all keys:
https://blog.railway.com/p/security-disclosure-wednesday-october-21st
Preliminary Report:
https://blog.railway.com/p/preliminary-report-october-security-incident
gitlab rce (going back 12 years):
http3 oom attacks:
Tailscale SSH Flaw:
node brotli RCE:
Some other interesting aggregate sites I found:
https://pwn.watch/
https://supplychain.fail/
Why?
I think a lot of people are asking this question right now.
Why all this week?
Why so severe?
Why such silly mistakes?
Here are a few thoughts and educated guesses:
Why this week?
Well, I think it’s mostly due to coincidence really. But there is another reason behind the scenes that we are seeing and many are predicting - AI. With intelligence readily available to more people, it is easier to find vulnerabilities and flaws.
As a result, we will see more and more of these instances simply because.
So where we would get one major issue a month, we may be getting at least one major issue a week.
Why so severe?
Because we didn’t have the time/bandwidth to find or fix all the things in the past?
Because most code inherently has vulnerabilities in it until it doesn’t?
Because we made our defenses to protect against human attackers and not machine attackers?
Because we’re using AI to ship things and not looking at the code or configuration and baking in security like we should be?
Emudhra Example (Hypothetical)
For example, the emudhra incident? A very silly and careless mistake was made when creating the signing keys. An error in the script resulted in the private key (aka password) being “4” instead of a long cryptographically secure key.
Hot take: What AI was used with a weak prompt or weak model to create it?
Just like the crowdstrike incident a few years ago, which was a bug, not a security flaw, was able to ship because there weren’t safeguards in place to test and catch these issues.
Railway Example (Hypothetical)
Let’s take Railway for example. After reading the report, it seems like someone had used an abliterated model (a model with no guards or safety) to attack and break out of their multi-tenant environment.
So their defenses were set up for human speed attacks, not machine speed attacks. Interestingly enough, they had a deployment setup to move towards a more secure single tenant environment the week after.
It was a tough week for DevOps and Engineers everywhere
Technology is hard. Incidents are hard. We try our best, but we can’t secure everything. We just need to roll with the punches and learn from the past. Kudos goes out to all the engineers and teams this week that worked extra hard to secure all the things.
What’s Coming in 2026 / 2027
I think we’re going to see a lot more of this.
We are in a transition period right now.
Attackers have tooled up for 2027, defenders are still stuck in 2025.
We will experience a lot of pain as an industry.
I’m optimistic though.
A friend told me about a platform he built from the ground up. He whitebox pentested software running on the platform and found no vulnerabilities. Not a single IDOR, XSS, or CSRF.
Take it with a grain of salt of course, but I think this is the future we need to build.
My friend Daniel Miessler has some succinct posts echoing the same thing:
Updates
GettingIntoInfosec.com Updated
I’ve updated the Getting Into Infosec website! Super happy about it. Here are some things:
Updated short links
Site wide player that will work across page loads
Transcribed episodes
Updated descriptions and summaries
Categories and filtering of episodes
Random Episode picker
Todo:
Sync updates back to the RSS feed
More coming soon!
Personal Website Update
I also finally updated my personal website with all my previous talks and mentions.
More coming soon.
SOC 2 Workshop
I’m taking all the experience working with startups of all sizes and helping them on their SOC 2 journey. This is an interactive workshop to go through your specific scenario and situation.
For example:
When should I do SOC 2?
How long will it take?
How much will it cost?
Will security questionnaires go away with SOC 2?
Thanks and stay safe out there!