sᴇғ

Gotham is not ready for me

🚨 Do you understand what happened in the last 48 hours.. > PHP, the code behind 69% of all websites, got 2 holes rated 9.2 out of 10, and the US, the UK and Japan told site owners to patch or go OFFLINE.. 4 days after hackers had already started trying the flaw.. > Japan's Prime Minister posted the request late at night.. the Finance and Health ministries pulled pages, MUFG Bank and JR West went into emergency maintenance, and Onamae shut ALL Desktop Cloud plans after malware hit up to 26,739 customer servers.. > India's eMudhra was caught with 8 intermediate certificate keys so weak one of them was literally the number 4.. the 60,000,000+ certificates it has issued can't be trusted.. > GitLab disclosed a 10.0 severity hole in every version since 2014.. the maximum score there is.. > criminals were caught using a literal AI hacking tool on 1,200+ sites.. it broke into more than 100 companies including John Deere and Cummins.. > LiteLLM, an AI tool with about 23,000,000 downloads a week, was secretly poisoned with a password stealer.. the bad version sat on PyPI for about 2 hours.. > State Bank of India, the country's biggest bank, confirmed 3,897 customer records on the dark web.. > WIRED now calls the PHP flaw "broadly exploited".. nearly 55,000,000 web properties still run PHP.. every single government on this list told PHP site owners the same thing within the last 48 hours.. patch it or take it offline.. all of this.. 48 hours.. if you're not following me you're finding out about this 48 hours late from someone who read my post.. it's only getting crazier from here..

This is the most serious 48 hours in cybersecurity history. "Black October" they're calling it It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year* SUMMARY OF THE LAST 48 HOURS: YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year): 1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline. 2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4. 3. California: data on every public school student since 2023 stolen, including disability status 4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers 5. Zeabur: 321,810 accounts breached. The company is shutting down. 6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer 7. GitLab: a 10-out-of-10 severity hole in every version since 2014 8. Cairn: criminals used an AI hacking tool to break into 100+ companies 9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline 10. Onamae: malware planted on up to 26,739 customer servers in Japan MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents): 11. Signal: a bug could leave your mic and camera on after you hang up 12. NGINX: 3 critical holes in software running ~1/3 of websites 13. HTTP/3: a single connection can crash 7 of the 10 web server types tested 14. Plex: hackers breaking into home media servers 15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations 16. Palo Alto: ransomware gangs breaking in through company firewalls 17. Bullhorn: platform used by 10,000+ companies knocked offline 18. Medi-Cal: 970,000 patients' data stolen 19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites 20. AOMEI: backup software's update server handed out a backdoor 21. Meta Muse: Meta's AI agent exposed users' personal and business secrets 22. Tor: 333 relays hijacked to steal logins 23. TiDB Cloud: database company's cloud breached Also serious: 24. State Bank of India: India's biggest bank confirms a data breach 25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool 26. Siemens: a software hole being used to spread malware 27. North Korea: state hackers launch a new attack campaign on South Korea