We released Ruby 4.0.9, 3.4.12, and 3.3.13, and published an announcement about Regexp compilation fixes.
https://t.co/zTemAPrS2A
If your application compiles a regular expression from an untrusted string, please update your Ruby to one of those versions.
they're calling it "Black October" and i don't think people realize how serious this is
in the last three weeks there have been more than 20 major cybersecurity incidents. not in a year. not in a quarter. in three weeks
any ONE of these would normally be the biggest story of the year
PHP: two critical holes in the code behind about 70% of websites. severity 9.2 out of 10. governments pulled their own sites offline
GitLab: where companies store their code. a perfect 10 out of 10 severity hole in every version since 2014
Railway: a service that runs apps for other companies was hacked. it told all users to replace their secret keys
LiteLLM: an AI tool downloaded about 23 million times a week shipped a password stealer for about two hours
Zeabur: an app hosting service says 321,810 accounts were hit. it's shutting down by the end of the year
Microsoft: says a China-aligned hacking group used AI helpers against hundreds of organizations. some fully taken over in under 3 hours
Ahold Delhaize: the owner of Food Lion and Stop & Shop pulled its websites and apps offline after an attack
and that's not even half the list
AI helpers are now doing the hacking. one hacker broke into more than 100 companies with them. about $50 a break-in
security experts are openly rattled. one at Johns Hopkins calls the internet "dry tinder". a former OpenAI researcher says it feels like March 1, 2020 for online security and asks if internet lockdowns are a couple of months away
if you run a website, use cloud apps, or keep passwords and keys saved online you are potentially affected
update everything. change your passwords on key accounts. turn on two-step login (2FA) everywhere. back up what you can't lose
this is not a normal week on the internet. this is something different