"Luck is not a factor. Hope is not a strategy. Fear is not an option." Shitcoiner, not your financial advisor | Wallet tracker | Grinding mostly from TG
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea
The internet is going into a LOCKDOWN.
Hundreds of millions of websites are potentially at risk from cyberattacks.
Governments, banks and major platforms have already taken their websites OFFLINE.
Many are already calling it “Black October.”
At the centre of the shutdowns is something most of us have never heard of, but use every day.
PHP, the software behind roughly 7 in 10 websites, has two critical flaws that can let hackers break in without a password.
Dubbed PHP2Shell, both are rated 9.2 out of 10 for severity.
Details began circulating on Oct 20. Emergency fixes arrived the next day, but attackers were already moving.
Cloudflare’s CEO says hacking attempts then jumped from thousands to MILLIONS within hours.
Cybersecurity agencies across several countries are telling PHP site owners the same thing: Patch it now, or take it offline.
Websites have gone dark worldwide, from government portals and hospitals to banks.
CrowdStrike warns these attacks leave almost no trace, so some sites may not know if they’ve been hit.
Around 2.6 MILLION internet-facing servers run PHP, potentially hosting hundreds of sites each.
Over 1.1 million use older versions no longer receiving official PHP updates.
Older installations may need an upgrade to a supported PHP version or a fix from their software provider.
And patching does not remove a backdoor an attacker may already have planted.
Cloudflare also says hackers are now tweaking their attacks to try to slip past its protections.
But PHP isn’t the only security story unfolding.
-Japan’s Onamae suspended ALL Desktop Cloud plans after malware was found on customer servers.
-India’s eMudhra had 8 website-certificate keys so weak, one was literally the number “4”.
-State Bank of India confirmed 3,897 customer records on the dark web.
-Criminals used AI agents to break into 400+ Latin American banks.
-Capcom confirmed a breach exposing 11.7 million email addresses.
-GitLab disclosed a 10/10 severity flaw in versions going back to 2014.
-LiteLLM removed a malware-containing release. Railway reported possible exposure of customer secrets.
None of these has a confirmed link to PHP2Shell.
We’re seeing separate breaches unfold together.
The true number of incidents could take months to come out.
The world is still on alert. Attacks are still coming.