Breaking Points & Yahoo Finance Lying About "Black October", AI Hacks & "Experts"

Summary

Internet of Bugs host Carl argues that media coverage of “Black October” exaggerated several cybersecurity stories, presenting them as an unprecedented crisis. He says some underlying issues were real, but coverage often omitted context and relied on claims from nontechnical commentators. His criticism is aimed particularly at outlets that, in his view, amplified the stories to attract clicks or promote AI companies.

PHP vulnerability and the “70% of the internet” claim

The central headline concerned AI finding vulnerabilities in PHP, alongside claims that roughly 70% of websites were at risk.

Carl says the vulnerabilities were real, but, as of the video’s recording, he had seen no evidence that anyone had been successfully hacked using them. He cites researchers who reportedly found that working exploits were unreliable and depended on narrow conditions, while noting that exploitation attempts had been reported.

He challenges the scale implied by the headline: many PHP sites are small, low-traffic websites, so a statistic about the share of websites using PHP does not mean most internet users or major services are exposed to an equivalent level of risk.

For historical context, Carl says PHP has had many critical vulnerabilities over the past two decades. He contrasts the attention given to the new bugs with CVE-2024-4577, which he says had infected 1,700 hosts by June 11, 2024, but received little mainstream coverage.

Carl’s broader assessment is sharply critical: he calls PHP a long-running security liability and argues that organizations prioritizing security should consider other options.

Other incidents grouped into “Black October”

Carl reviews several other stories presented as part of an unusually bad cybersecurity period:

• eMudhra TLS certificates: The certificates were reportedly insecure, but Carl says the issue was found by a four-year-old sanity-checking tool, not AI. He attributes the faulty certificate-generation script to a 2025 error and says AI may have contributed, though he acknowledges the company did not state that it used AI.
• Railway: He describes a serious security failure involving customer secrets being accessible to other customers and says users should leave the platform. Railway reportedly believed an attacker used AI. According to the account discussed in the video, stolen customer keys were used to steal cryptocurrency and incur AI-provider bills.
• GitLab: A separate vulnerability was reportedly found manually, without AI’s help.
• AI agents and bank accounts: Carl says these reports involved customers deliberately giving bots their login credentials, rather than conventional hacks.

Carl concludes that these events did not amount to an unprecedented cybersecurity week. He believes they were grouped together to reinforce a sensational narrative.

Carl’s concerns about AI and security

Although he rejects claims that AI has suddenly made hacking superhuman, Carl identifies several risks:

• AI tools may lead to more insecure code being produced and deployed.
• Attackers may use models trained on hacking scenarios to carry out familiar attacks more easily, increasing the workload for already stretched security teams.
• AI systems are not necessarily better than professional attackers. In Carl’s view, they may leave more evidence because they are less capable of concealing their activity.
• Businesses may waste money buying AI defenses instead of funding established security measures. Carl argues that effective protection requires practical investment and preparation, including setting up detection tools before an incident occurs.

Carl frames weak organizational security—especially executives’ reluctance to fund it—as a more persistent problem than “superhuman AI.” He says better monitoring can help detect intrusions, but emphasizes that tools need to be configured in advance.

Reviews, guides, and tutorials

No product review or step-by-step tutorial is presented. The video is an analysis and explainer, using historical comparisons and examples to put recent security headlines in context. A brief SNL UK comedy excerpt explains PHP in intentionally simple terms.

Main speakers and sources

• Carl, host of Internet of Bugs, delivers the analysis and describes himself as a software professional since the late 1980s.
• SNL UK performers appear in a short satirical clip about PHP.
• Breaking Points commentators are heard in excerpts and criticized by Carl.
• The video also refers to vulnerability databases, security researchers’ assessments, and statements attributed to eMudhra and Railway.