[AINews] Black October

If you are reading this, you’re receiving this from our new provider, Beehiiv! We are making progress on our redesign — if you have a friend that didn’t receive AINews, please find us in Spam filter and move us out to your Inbox… thank you! AINews is now free… we are building new subscriber benefits soon. We ordinarily try not to repeat title stories if we already covered it, as we did Patch the Planet yesterday and our Cyber trend call in July. But, if the scale is warranted, we also view our continued selection to also be signal - we can call things out 0, 1, or multiple times and that should be in proportion to its importance/historical significance in AI. We last did this with OpenClaw. “Black October” counts as such. Here’s a list: Scale of the incident wave: Over roughly 48 hours, a cluster of critical disclosures and breaches landed together (summary, roundup, patch list). Core software: PHP2Shell is an unauthenticated RCE in PHP. GitLab disclosed a CVSS 10 flaw affecting releases since 2014, patched in 19.5.1. Node.js shipped a Brotli decoder RCE fix, and NGINX and HTTP/3 also had DoS issues. Supply chain: LiteLLM 1.107.0 shipped…