27 major security incidents in 48 hours: inside 'Black October,' where one certificate key was literally the number 4

A post cataloging 27 hacks and critical flaws disclosed in just two days, billed as "the most serious 48 hours in cybersecurity history," passed 16,000 likes and 1.1 million views on X on Oct 22.

The account AISafetyMemes dubbed it "Black October" and counted 10 incidents that would normally rank among the biggest of an entire year, on top of the PHP and LiteLLM breaches we covered earlier. Per The Register, one of the private keys Indian certificate authority eMudhra used to sign certificates was simply the number 4, and several others were two- or three-digit numbers, making it possible to forge certificates and impersonate websites. eMudhra blamed a flaw in its key-generation ceremony that produced a second set of weak keys.

Developer hosting platform Zeabur said attackers used admin credentials it had stored in plaintext to steal data on 321,810 accounts and about 3.2 million environment-variable records, and that it will shut down by year-end. Microsoft said Oct 21 that China-aligned group Storm-0940 used an agentic AI pen-testing framework called ARTEX to target hundreds of organizations, in some cases gaining privileged cloud access less than three hours after picking a target. GitLab also shipped an emergency patch for a perfect-10 severity bug spanning 12 years of releases.

Why now? Developer and streamer Theo Browne's theory spread widely. Per BigGo Finance, he argued after Railway went dark for more than 16 hours on Oct 21 that AI labs' crackdown on model distillation has created a black market for stolen Anthropic and OpenAI API keys, turning every platform that stores customer secrets into a target, and that agents can now turn patch diffs into working exploits almost on demand. Security firm GitGuardian told Railway users to "treat every env variable as exposed."