They Told You It Was "Black October"...

Summary

The presenter argues that “Black October” was framed as a possible internet-wide cybersecurity crisis, but that the scale and timing of the threat were presented in a misleading, alarmist way. The underlying vulnerabilities were real, the presenter stresses, but the claim that AI had exposed a flaw putting 70% of the internet at risk did not mean that 70% of websites were actively compromised.

PHP vulnerabilities and disclosure

The focus is on two severe PHP remote-code-execution vulnerabilities, disclosed and patched on October 21. The presenter says they were first discovered in August through work involving OpenAI’s “Patch the Planet” initiative, security firm Kalif, and Wiz. The roughly 81-day gap before public disclosure is described as coordinated disclosure—a normal process intended to give developers time to fix issues—rather than evidence that the flaws appeared suddenly in October.

The video also challenges the impression that a large wave of unrelated vulnerabilities all emerged at once. Many incidents included in “Black October” summaries had reportedly been found earlier, making their clustered announcements look more like a planned release schedule than a spontaneous crisis.

Evidence of attacks

The presenter points to a lack of publicly reported major breaches and to security monitoring reports that found attack attempts but little evidence of successful exploitation. Cloudflare did record a sharp rise in attempts after disclosure, however, and the presenter acknowledges that some attempts were reported.

The disclosure process itself may have increased risk: details reportedly leaked before the intended announcement, and Amazon recorded an attempted exploitation on October 17. The video also cites a separate report that eight eMudhra intermediate certificates had keys generated with insufficient randomness as another example of serious security problems surfacing around the same time.

Concerns about incentives and messaging

The presenter raises concerns about incentives. OpenAI’s model was involved in finding the PHP flaws, while OpenAI also promotes Daybreak, a suite of AI security products that includes Patch the Planet. Wiz publicized the “70%” figure and, according to the video, was owned by Google.

The presenter argues that companies selling AI and cybersecurity products had an interest in emphasizing the danger, and characterizes the resulting coverage as a marketing campaign. These are the presenter’s interpretations, not proof that the vulnerabilities or attacks were fabricated.

Potential impact and conclusion

As evidence that the PHP flaw could still be dangerous, the presenter describes a “Steal My Bitcoin” challenge in which a site containing cryptocurrency was reportedly hacked using a PHP exploit. The presenter cautions that the challenge had technical problems, making the speed of the exploit difficult to assess.

The conclusion is that most ordinary users were unlikely to face direct risk from the described attack paths, while unpatched legacy systems, industrial infrastructure, and poorly maintained services remained vulnerable. Overall, the presenter’s view is that “Black October” exaggerated a real security issue into an internet-wide emergency.

Presenters and contributors

• Presenter: Upper Echelon host; not named in the subtitles.
• People cited: Joshua Akyampong (whose name appears inconsistently in the subtitles) and Sam Altman.