B retweeted
# Black October
For anyone who knows me even somewhat well, it's clear that I am a 99th percentile tech optimist. However, the vibes have shifted for me quite a bit in the last 18 hours, and I feel a moral imperative to share what I'm thinking and feeling with my circles so that everyone can understand, and hopefully take seriously, what's happening right now. I think October 2026 will have many chapters written about it in the history books.
You know those scenes in financial movies like Margin Call where someone realizes that they're all fucked, and no one else sees it yet? And that person feels like they're crazy, and then suddenly everyone is pulling an all-nighter in a boardroom and freaking out? Yeah, that's kind of how this is feeling right now in the SF/Bay Area/AI circles.
We're 48 hours into what is being called Black October. In the last 2 days there have been several dozen cyber attacks which, in isolation, would each have been the worst to happen in an entire calendar year. Every sector from government to education to big tech and banks is being massively affected, and people are starting to freak out.
In a nutshell, what's happened is that frontier AI models have gotten to a point where they are as advanced as the most sophisticated programmers, with one critical difference: they can work 24/7, and you can spin up 10,000 of them with a single command and they'll work together tirelessly until they accomplish their task. The most advanced models today are from companies like Anthropic and OpenAI, whose current best technology is so good that they haven't been able to roll it out to everyone yet because of the national security risks it poses.
Meanwhile, the best open source models (where anyone can just download the model weights and do whatever they want with them, uncensored) are slightly behind the frontier but still 90-95% as capable. These models, developed primarily in China, are being used by black hat hackers to wreak havoc on the Western capitalist structure. Presumably, this has been part of China's plan the entire time, and we're seeing its implications fall out in real time.
In red-pilled AI circles, we've been sharing and reading papers called things like "Situational Awareness" and "AI 2027" for the last year or so, which at the time felt a bit like near-term speculative fiction. They laid out the case for why Artificial General Intelligence (AI smarter than any human at any knowledge task) and Recursive Self-Improvement (models that are able to use themselves to get better) weren't half-baked future ideas anymore, but instead an inevitable outcome of the linear progress that's happening.
These papers would then talk about things like "takeoff scenarios," trying to envision how that moment would come to be and what it would be like when it happened. It would either be a "slow takeoff" that would play out over the course of months and quarters, happening subtly and only obvious to a few. Or, it would be a "fast takeoff" where it would pretty much happen instantly, like a bit flipping from 0 to 1.
From everything that I can see and am feeling, we are currently experiencing the fast takeoff scenario. Beyond the crazy security vulnerabilities that have come out recently, there have also been massive breakthroughs in life sciences, fundamental computer science, materials science, and pure mathematics that have all landed in the same time frame. While I still firmly believe that AI will be a net positive for humanity, it's more clear to me than ever that the societal and individual risk is very real, and is playing out NOW.
For as much conviction as I have that this is happening, the thing that's caused me to lose sleep is that I don't really know what to do about it, or more importantly, what to tell you, reader, to do about it. So, the best I can do is make a few suggestions that have always been a good idea but are more timely now than ever:
Set up 2-factor authentication for everything. I use Duo.
Use a password manager across your devices. I use 1Password.
Get an identity protection app set up. I use Alta.
Move your IoT devices to their own network. Claude helped me do this.
And last, but certainly not least, if you've been avoiding leaning into AI, see this as a catalyst to wake up and start using it. Don't just use the chat mode version of ChatGPT/Claude; click that Code/Work button and see how easily you can have AI write code to help you with your job. One of the biggest vulnerabilities was in a massively popular programming language called PHP, and the prompt that set it off was literally, "Find vulnerabilities in php."
This is an unprecedented time for humanity, but as we've done with many things before, we will prevail so long as we are kind, loving, and open-minded to the world.
Much love.
B retweeted
Thankfully I think that’s about it for the security vulnerabilities and we probably won’t find any more
B retweeted
Almost 70% of the web compromised, humans and AI working together to fix it, and literally nobody in my everyday life has a clue what I'm talking about.
B retweeted
When you dont understand any of the code or the apps you’ve vibe shipped over the last two years and you’re seeing every cloud provider get hacked
An urgent notice from the Railway team
blog.railway.com/p/security-…
So today PHP had to patch two critical bugs that can let someone run code on an affected server without even logging in, which is bad, and details were circulating before the patches landed, which is worse, and PHP is underneath WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys counted about 1.5 million hosts running versions without a fix, so the NSA’s advice was basically patch it or take it offline, and the FBI’s advice was patch it or take it offline, and the UK and CERT-EU were saying the same thing, and then the actual Prime Minister of Japan was publicly telling people to check their websites and patch or suspend them, because apparently we have reached the point where updating PHP is a head-of-government responsibility.
And then websites started disappearing. Government services across Europe. Wikimedia systems. The Dutch cybersecurity agency took its own website offline, which is an especially reassuring thing to see from the people responsible for cybersecurity. And that’s just PHP.
Because GitLab also released a fix for a CVSS 10.0 vulnerability, which is the highest score available, affecting versions going back to 2014, so that’s twelve years of releases with a bug that could let someone run code without logging in under the right conditions. Twelve years.
Meanwhile, LiteLLM 1.107.0 got hijacked and shipped credential-stealing malware and a remote-code execution mechanism in its Python wheels and Docker images, including latest, and you didn’t even have to import the library—the payload could run when Python started. This is its second supply-chain compromise this year. Railway paused all deployments while investigating possible access to customer environment variables and told everyone to rotate their secrets, so even if your application was having a perfectly normal Wednesday, your hosting provider had other plans.
TiDB Cloud’s operator disclosed that someone had been accessing internal systems with stolen credentials for nearly a month, and Zeabur, after its second breach in two months, announced that it is shutting down. The company. Not a server. The company.
Oh, and eMudhra, a certificate authority whose entire job is helping prove that websites are who they say they are, had eight certificate-signing keys so weak that researchers could recover them almost instantly. These are supposed to be enormous, unpredictable numbers. One of them was 4.
Just 4.
Other keys included 66 and 237, so there was apparently an advanced tier.
Anyway, it’s Wednesday.
B retweeted
There were reports of usage draining faster than anticipated for some users over the weekend. We've identified approximately 40,000 accounts that had an inconsistency on which usage limits where the actual usage that was applied did not correspond to their actual selected plan. We are reaching out individually to all these users and have corrected the issue. If this affected you, we'll add credits to your account. Sorry we got this wrong.
B retweeted
NATHAN FIELDER: So you see he's ordering 55 burgers and 55 fries and 55 tacos and 55 pies and 55 Cokes and so on.
ELIZABETH HOLMES: Yes.
NATHAN FIELDER: So why is that funny?
ELIZABETH HOLMES: Because he's...doing...something?
BILLY EVANS: That's enough for now. Cut the camera.
B retweeted
The "Texas Transgender Student Union" that sent out mailers, which have become a major controversy among Republicans, is a real organization — but it was only formed in September in Wyoming as an LLC and is entirely separate from TENT, the organization marketed in the fliers.
B retweeted
One of the proudest DC traditions: ads micro-targeted at one procurement guy at the Pentagon
B retweeted
Family Guy recently made a Civil War version of "Who's on First" that had me crying laughing. It had no business being that good.
B retweeted
This is Tommy. Tommy had a question about my allegiances. Listen to the end to hear about his.
B retweeted
BREAKING: Ukraine has carried out the world’s first medical evacuation of a human via a drone from the battlefield the 30th mechanised brigade of Ukraine managed to save their injured comrade from a minefield.
Just absolutely insane.



























