"Black October"
Oct. 22nd, 2026 07:02 pmThere’s nothing quite like seeing this month getting dubbed "Black October".
tl;dr — unsurprisingly, folks are freaking out, with some good reason, over the growing deluge of severe security bugs being discovered via #AI. The fact that #eMudhra and #PHP2Shell became publicly known within hours of each other isn’t helping.
I'm sort of taking it in stride, mostly because it's been so horribly obvious for a while that this was coming. Most of the Internet is really badly written, vulnerabilities are rife, and with LLMs getting better extremely quickly it was inevitable that the script kiddies would start to realize the potential for lulz. (Criminals as well, of course -- but I suspect a fair fraction of this is just bored idiots causing trouble for fun.)
I'm concerned, but not doomstering to the degree some are. I think some sites will get slammed to the ground, especially ones that are poorly maintained. But this week (especially PHP2Shell, I think) has been a useful wakeup call that companies can no longer treat security as an optional expense line: if you want to run a business, you have to be dealing with this stuff.
In the long run, that's probably a good thing, and will hopefully help spread the clue of how to build software in responsible ways.
(Editorial: 90% of security is knowing how not to be gratuitously insecure in the first place -- including choosing the right tools. My fondness for the #Scala #Typelevel stack isn't just because it's fun to use: it's generally well-designed as well, and that at least reduces the attack surfaces.)
But in the meantime, yeah: it's a good time to make sure you have two-factor authentication on all your really important accounts, you've got strong passwords that are different for each site, and be conscious of the fact that pretty much anything online, anywhere, is subject to being hacked.