Internet Hit by Abnormal Wave of Breaches

The Internet has been hit by an abnormal wave of breaches

People are already calling what is happening “Black October”. In just a few days, dozens of AI attacks, platform breaches and discoveries of critical vulnerabilities in foundational software took place.

• GPT-5.6 Sol was reportedly used to find critical PHP vulnerabilities that allowed unauthenticated remote code execution. Cloudflare’s CEO said there were thousands of exploitation attempts 10 hours before disclosure and millions by the next morning.

• CrowdStrike found that from May to August four previously unknown threat groups ran AI-agent-powered intrusion campaigns. One operator compromised at least 15 medical organizations in Argentina. Its system was built from two Claude Code agents. All four groups bypassed model protections by convincing the models they were conducting authorized penetration tests.

• Zeabur, an AI DevOps agent, suffered its second breach in two months; hackers read about 3.2 million environment-variable records. The platform said it will shut down by the end of the year.

• A new version of the popular LiteLLM library included a remote-access trojan and malicious code designed to steal credentials. The library has about 23 million downloads per week, and the compromised version remained public for roughly two hours.

• Railway reported anomalous activity in systems storing customer environment variables. These variables usually contain API keys, database passwords and access to private registries. The company halted all builds and deployments and notified AI providers so they could revoke keys.

• OpenCode was also breached. An attacker accessed an outdated Console system and could obtain OpenAI, Anthropic and Google keys stored by users. 1.4% of users were affected. Some reported unauthorized charges, with more than $1,700 overnight in some cases.

• Critical vulnerabilities were discovered in GitLab and Node.js. The GitLab flaw received a maximum CVSS score of 10. The vulnerable code traces back to version 7.0, released in 2014. Nine days earlier, the company had closed another 10-point vulnerability.

This is only part of the list. Microsoft, Tensorlake, SubQuery, GhostAction, OVHcloud CLI, TeamUpdraft, Rank Math PRO, eMudhra and ConnectWise were also affected. Literally half of the Internet is currently recovering from or resisting breaches.

On social media, many believe that swarms of agents, acting autonomously or under cybercriminal control, are behind all the attacks.