[AINews] Black October
- ID
- 38690
- Status
- summarized
- Published
- 23 Oct 2026, 6:09 PM
- Fetched
- 23 Oct 2026, 7:06 PM
- Provider
- Latent Space
- Category
- developer-ai
- Original URL
- https://latent.space/p/ainews-black-october/
- Source URL
- https://www.latent.space/feed
Summary
- Score
- 8.5
- Created
- 23 Oct 2026, 7:07 PM
- Tags
- Audience
- developersvibe_codersai_agentssaas_founders
What happened
Latent Space's AINews roundup documents a ~48-hour cluster of critical disclosures it calls 'Black October': an unauthenticated RCE in PHP ('PHP2Shell'), a CVSS 10 GitLab flaw affecting releases since 2014 (patched in 19.5.1), a Node.js Brotli decoder RCE fix, NGINX and HTTP/3 DoS issues, LiteLLM 1.107.0 shipping with a password stealer, Railway telling users to rotate secrets after possible customer-key exposure, Zeabur shutting down after 321,810 accounts were breached, and eMudhra CA key compromise. The piece frames the volume of simultaneous patches as the story, not any single CVE.
Why it matters
Three of these hit stacks this audience actually runs: if you deploy agents through LiteLLM, treat version 1.107.0 as compromised and pin/upgrade; if you host on Railway, rotate every secret and env var now rather than after an incident review; if you're on Zeabur, the shutdown after 321,810 breached accounts means migration is urgent, not optional. GitLab admins should confirm they're on 19.5.1 or later, since the CVSS 10 flaw reaches back to 2014 releases.
Discussion angle
The LiteLLM and Railway items are the same lesson twice: your agent stack's dependency and hosting layers are now the soft target. Worth walking through what a secret-rotation drill actually looks like for a small team, and whether anyone has an exit plan for their PaaS provider.