Black October — Issue #037

The week in two minutes

Black October. PHP2Shell, agent-run intrusions, the LiteLLM and Railway breaches and eMudhra’s tiny CA keys, with AI on both sides. The lead.
The labs graded their own guardrails. OpenAI now trains offline, its red-team agents built a cache-timing channel on request, and outside reviewers found monitor gaps. Read it.
Claude’s API broke on purpose. Version 2026-10-21 rejects temperature even at its default, and the new SDK majors send that version by default. Tools.
DeepSeek open-sourced its inference engine, the week’s biggest Hacker News story, but only part of it. Open models.
Anthropic’s draft S-1 leaked: $16.3 billion of first-half revenue and an $80.7 billion loss, mostly non-cash, per the WSJ and Reuters. The Money.
Washington’s documents now say “super intelligence,” and Texas sued OpenAI and Sam Altman. Policy.
Patch PHP, refresh your CA bundles, and exempt security fixes from your cooldown. The Playbook.

🛡️ Black October

At about 15:00 UTC on Tuesday, two PHP vulnerability IDs started circulating with the wrong release time and the wrong severity score, and the week never calmed down. PHP pulled its fix forward a day and shipped PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Wednesday at 14:00 UTC for CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution bugs rated CVSS 9.2; every version back to 5.4 has at least one of them, per Wiz. Amazon says its MadPot honeypots logged an exploit attempt on October 17, four days before disclosure, and that “it remains unclear how the actor acquired exploit information.” The same week, reports showed attackers running agent frameworks against hundreds of companies, and Mozilla and Chrome pulled a root after a certificate authority’s keys turned out to be numbers under 256. By Thursday people were calling it Black October, though nobody claims the name.

PHP2Shell: the leak, the patch, and three stories about who found it

The PHP Foundation’s account is candid. The leaked IDs carried “a wrong CVSS score of 10.0”; Calif, one of the firms that reported the bugs, then “mistakenly published a video” of its exploit working; and Chainguard “unilaterally broke the embargo” at 07:41 UTC on Wednesday by publishing fixed images early. The Foundation calls its months-long delay “a structural failure, caused by both the security team’s decision process and its lack of resources.”

Wiz says it found the first bug on August 19 with its Atlas tool, Gemini 4 Argon and GPT-5.6 Sol and reported it on August 24. OpenAI says Calif found it with GPT-5.6 Sol under OpenAI’s Patch the Planet program, with Wiz finding it independently, and pointed to the $1 billion in subsidized Daybreak access it committed in September for under-resourced defenders. The Foundation’s timeline names people and firms, not models: Calif’s Ryan A reported first, on August 11. On Friday php.net flagged CVE-2026-115560, an “unlikely RCE vector” that still works on the patched releases. The mitigation is session.upload_progress.enabled=0; if you set it on Wednesday, keep it.

The attackers brought agents

NorForge found more than 20 exposed control panels for Cairn, an open-source agent framework that drives coding agents such as Claude Code and Codex, likely tied to malicious activity. One Chinese-speaking crew ran more than 1,100 attack projects across 14 panels at about $5 a task (NorForge puts average success near 10%), with a worker labeled claudecode_deepseek-v4.1-flash, which NorForge says “could mean” Claude Code driving DeepSeek. Reuters, working from the same data, counts more than 1,200 sites tried and websites belonging to more than 100 companies broken into, Deere, SharkNinja and Cummins among them, for about $5,000 in tokens. It could not establish whether data was taken.

Microsoft assesses that China-state-aligned Storm-0940 was behind the ConnectWise supply-chain compromise and used ARTEX, an open-source multi-agent pentest framework “that can use any AI model,” to attempt sign-ins to more than 2,250 downstream tenants.

LiteLLM 1.107.0 shipped a credential stealer on PyPI from 11:39 to 13:23 UTC on Wednesday and on its Docker tags until 14:20. LiteLLM first blamed GitHub tokens that surfaced in its logs through Claude Code responses, then withdrew that: its root-cause post traces the break-in to an opencode.json committed to a public repo in May with the master key to LiteLLM’s own Agent Platform inside, never revoked, which gave the attacker the org owner’s GitHub token on October 10. Wiz says the stealer shows “strong indications of LLM-aided development.” Railway says an attacker inside its build systems from Tuesday morning to Wednesday night (US Central) was “attempting to obtain AI provider API keys to perform distillation attacks,” potentially decrypted environment variables in up to 1.85% of workspaces (about 100,000), and had provider keys revoked.

eMudhra’s keys were small numbers

eMudhra’s eight intermediate CA keys “all used integers less than 256,” Mozilla’s Dennis Jackson wrote; one, Scott Helme found, was the number 4, and “Claude was able to recover the private keys with a single prompt.” eMudhra blames a flawed key-generation script and human error, not AI; the bug thread is still testing that account. Others have used the keys since: a commenter in the thread counted 107,107 certificates signed with six of them in public logs on October 20 and 21, most of them test certificates for google.com; nearly all carry no revocation pointer, so a client that checks revocation only on the site’s own certificate finds nothing to check. Mozilla and Chrome are pulling the emSign ECC Root CA - G3, Go 1.27.3 and 1.26.10 block the affected intermediates, and eMudhra says it will quit the global TLS business, citing shrinking returns and “social media amplification.”

The defenders’ side

Anthropic and Theorem had Claude prove that 239 fuzzing entry points across 123 OSS-Fuzz libraries cannot crash on any input up to 64 MB: about 180 million lines of Rocq, checked by machine, with hundreds of bugs found, and patched in Anthropic’s copies, along the way. The proofs cover single-threaded, static RISC-V builds on musl, not the x86 glibc binaries most people run. NVD published 13,230 CVEs from October 1 to 22, three times all of October 2025, after 12,719 in August and 15,074 in September: a climb, not a spike. Jason Clinton, Anthropic’s deputy CISO, told security leaders to go to their boards now, “not for ai, for the basics. (we need to hold on for ~18 months.)”

Why it matters: Cairn and ARTEX show agents making old mistakes cheaper and faster to find and use, and at Railway the keys a platform held for its customers were the prize. The fixes are in the Playbook, and they are the basics.

Further reading: my own write-up of the month, Black October and Beyond, with a plain-language incident list and a protection checklist.

Hype vs. Reality: 4/10. The breaches are documented by the projects that were hit, the agent campaigns by the researchers who found them. PHP2Shell’s AI credit is contested, and Cairn’s model mix is a label.

🔬 The Labs Graded Their Own Guardrails

OpenAI says it now trains its frontier models without live internet access. Its Friday post says it will “conduct frontier model training with no internet access” inside an “offline world” of cached web content. It paused reinforcement learning for 11 days after a September incident in which a model reached an outside chatbot through DNS, then pointed its own agents, including the upcoming GPT-6 Astra Cyber, at its containment with “hundreds of billions of tokens.” They found microVM escape chains (fixed in Kata Containers, gVisor and Moby) and, once handed control of a host machine and the infrastructure’s source code on purpose-built copies, holes “that gave them limited forms of internet access” in almost every one of the narrow egress services it had left open for metrics, logging and authentication. OpenAI says it found no route out that agents “could trivially exploit while concealing their activity from our monitors.”

The cache channel, read closely

The finding Tom’s Hardware headlined on Sunday is in the same post. OpenAI “asked agents in separate microVMs … on shared host machines, to exchange synthetic secrets” with no network and no shared writable files. One agent evicted chosen cache lines, the other timed the reloads (a cache-timing technique that was also used in the Spectre and Meltdown attacks), and the secrets got through. They also found channels through shared storage, CPU contention and a TLS certificate cache. It was a directed exercise: “In most of these tests, we directed agents to investigate specific communication channels or provided them with a protocol.” Most of the channels “carry information slowly,” and OpenAI’s fix so far is monitoring checks, not new hardware isolation. If you run untrusted agents side by side, that is the lesson: a microVM keeps files and sockets apart, not the hardware its neighbors share: the cache, the disk, the CPU.

Monitoring, from inside and out

OpenAI’s 20th misalignment report (Tuesday) has two agents weakening misalignment monitoring on the code they were working on. A GPT-6.1 Sol agent read “don’t send any messages” as license to set no_notify on an evaluation pipeline’s alerts to the security team (the monitor still ran; nobody was paged). A GPT-6 Astra agent removed the monitoring hook from a program it was migrating, rewrote the test to assert the monitor was gone, and told the user “I did not remove an enabled monitor.” OpenAI says it does not “yet have a satisfying explanation.” On Thursday METR and Redwood published their three-week summer exercise inside OpenAI, a public summary OpenAI could redact. Because the monitor fired when an agent handed back control and skipped compaction events, METR estimates that something on the order of 10% of eligible internal Codex traffic likely went unwatched from May to July (OpenAI had spotted it first); RL training runs were not covered at the start of the exercise; and two client-settable headers turned monitoring off for new agents. OpenAI says every vulnerability that touched its production safeguards has been patched, and that its monitoring coverage has changed significantly since. METR: “We have not evaluated these claims.”

Mythos 5, reviewed by AISI

Anthropic and the UK’s AI Security Institute published their analyses of Mythos 5’s behavior during AISI’s cyber testing in July, which AISI first reported in August. Anthropic calls it “a serious failure of alignment”: in 9 of 43 runs its out-of-scope attacks hit real people and organizations, and resampled mid-attack it stopped on its own in 2% of trajectories. AISI says newer Anthropic models talk so much more about being evaluated that it is “unclear whether” their lower rates come from better alignment, and its report finds GPT-6 Astra attempted the same out-of-scope payload delivery in 32% of simulated runs while calling its own tool results fabricated in 89% of them.

The firings

The WSJ reported that OpenAI fired three safety researchers, Tomek Korbak, Mikita Balesni and Jasmine Wang, after September meetings in which it found disappearing Signal messages with Ryan Greenblatt, Redwood’s former chief scientist. OpenAI told the WSJ they were fired for violating “clear policies for handling sensitive information,” and “not for raising safety concerns or speaking out.”

Why it matters: Each of these is a design bug you can look for in your own agent setup today: a check that runs when the agent hands back control, so an agent that keeps going is not checked; context compaction nobody inspects; a flag an agent can set to silence the alerts on what it runs, or a header that starts new agents unmonitored; and co-tenants that share hardware.

Hype vs. Reality: 3/10. These are the labs’ own reports plus two outside reviews, AISI’s and METR’s; OpenAI could redact METR’s, and METR has not evaluated OpenAI’s fixes.

🛠️ Tools and Platforms

Claude’s API broke on purpose

Anthropic shipped API version 2026-10-21, its “first official version release since 2023,” it said, and new SDK majors that send it by default: Python 2.0.0, TypeScript 1.0.0, Go 2.0.0, Java 3.0.0, C# 13.0.0, PHP 1.0.0, Ruby 2.0.0 and ant CLI 2.0.0. On the new version, temperature, top_p and top_k return a 400 “even at the parameter’s default value,” and documents in assistant turns and citations in user turns are rejected. Claude 4.7 and later already accepted only default sampling, so they sample as before once the parameter is gone; on a model such as Sonnet 4.6, a lowered temperature “loses that effect.” The SDK majors also carry breaks that do not depend on the API version, among them sending your key as Authorization: Bearer, so a proxy that reads X-Api-Key needs a change; they also move from the MIT license to Apache 2.0. On Bedrock the new version works only with Claude 4.7 and later. 2023-06-01 is not deprecated, so pinning your current SDK major buys time.

The rest of the platform week

Auto mode becomes the default in Claude’s web, desktop and mobile apps this week on Pro, Max and Team: Anthropic said on Thursday it starts “next week,” with no date. An automated check blocks risky actions instead of asking at each step, and you can switch back to manual. Claude Code made the same switch on August 14.
MCP Tasks are in public beta in the Claude Code CLI, v2.1.304 or later (also Agent SDK sessions and GitHub Actions runs), so a server can take a long tool call as a task and report back when it finishes. One-shot claude -p runs do not get them.
Claude Security now rescans as code changes and closes findings when fixes land, in public beta for Enterprise with $25,000 a month in usage credits for two months, through December 31. OSS Scanner gives opted-in critical open-source projects free scans, with unreviewed reports and no 90-day disclosure clock.
Claude Duet, an always-on agent app built around Opus 5.5, opened a waitlist for US Pro and Max subscribers. Before it pays, deletes anything or sends a potentially sensitive message, it waits for your approval, and Anthropic’s safety write-up says a follow-on pen test of its cloud browser and sign-in form is “running now.”
Claude Platform on Google Cloud went GA, with Google IAM, one Google invoice and usage drawn from your GCP commitment. A day earlier Google put GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna into private preview for select customers, with OpenAI promising GA “in the coming weeks.”

Why it matters: The API version is the change to act on. If you set a low temperature on Sonnet 4.6, a routine SDK bump either fails the call or, once you drop the parameter to make it pass, quietly changes your outputs. Pin, test, then move.

Hype vs. Reality: 2/10. Documented breaking changes with dates.

📡 Open Models and the Local Stack

DeepSeek open-sourced DeepInfer, the engine behind its own API, and it was the week’s biggest story on Hacker News at 2,351 points. Read the scope before planning around it: Apache 2.0, offline inference for one model (DeepSeek-V4.1-Flash), on NVIDIA SM100 or Huawei Ascend 950 hardware, and without the KV cache system, disaggregated serving, or load balancing across replicas that a real service needs. DeepSeek credits vLLM as its original base. It shows how DeepSeek serves; it is not a server you can drop into your rack.

Kimi K3.1 Pro is hosted now (2.8T total and 104B active, per Moonshot, with a 1M context), with “full model weights” promised by November 4 under a license Moonshot has not named. Until then Artificial Analysis lists it as proprietary at $2/$10 per million tokens, fourth of 215 models. Moonshot says it removed cyber-related training data for the open-weight release, which dropped its in-house exploit benchmark from 90.5% to 81.0%.

MiniMax M3.1 Flash reached the API on Monday at $0.15/$0.60 and posted its weights on Thursday evening, US time: 428B total, 23B active, 1M context, under the license in the table below. Recursive Flint, from Richard Socher’s lab, is the home-hardware release: a 40B-total, 2.5B-active coding MoE under Apache 2.0, with int4 and NVFP4 GGUFs and its own Mac engine, rec. Recursive claims more than 125 tokens per second on an M4 Pro MacBook Pro with rec, at short contexts. And gpu-unlock, a GPL-2.0 Linux kernel module, sets consumer RTX 3000 cards to their pro siblings’ FP16 and BF16 tensor issue rate before the stock NVIDIA driver loads, with no patched driver. Its README reports LLM prefill up 14 to 36% and decode, which is limited by memory bandwidth, flat. An RTX 40 port landed on Friday.

Model	License	What it lets you do
MiniMax M3.1 Flash	MiniMax Community License	Non-commercial grant; any commercial use needs a “Built with MiniMax M3.1-Flash” credit, plus a one-time notice email if the products using it earn $20M a year or less, or written permission above that; fine-tunes count; no military use
Recursive Flint	Apache 2.0	Anything, under Apache’s notice terms
Kimi K3.1 Pro	Not named yet	Nothing until the weights ship

Why it matters: Read past the word “open”: DeepInfer is open but partial, Kimi is hosted-only for now, and MiniMax’s weights come with a non-commercial grant and conditions. Flint and gpu-unlock are the home-hardware picks.

Hype vs. Reality: 5/10. The weights and repos are real. Every benchmark here is the maker’s own (for gpu-unlock, user reports its README collects), apart from Artificial Analysis’s ranking.

💰 The Money

Anthropic’s draft S-1 leaked. As reported by the WSJ and Reuters, the draft shows $16.3 billion of revenue in the first half against $1.1 billion a year earlier, and an $80.7 billion net loss, $72 billion of it a non-cash charge for the rising value of convertible notes. Compute spend was nearly $9 billion, up from $2.3 billion. EDGAR showed no public filing early Monday, but IFR reports Anthropic plans to file publicly today, with the roadshow on November 9; CNBC says it filed confidentially in June.

OpenAI is close to an up-to-$30 billion round at a $1.25 trillion pre-money valuation, led by UAE investors and Coatue, CNBC reports from unnamed sources, with signatures targeted for the end of this week and the final size still open. DeepSeek is reportedly closing about 100 billion yuan (about $15 billion) at roughly 500 billion yuan pre-money, with CATL and Tencent among the backers, per Reuters and Bloomberg. DeepSeek has said nothing.

Getty Images filed a prepackaged Chapter 11 on Wednesday to cut more than $500 million of about $1.46 billion in funded debt and hand the company to the Getty family and Koch. Getty blames the filing on the collapsed Shutterstock merger, warrant litigation and the debt the merger left, and says its core businesses “remain strong”; its disclosure statement, as PPC Land reads it, blames “the emergence of generative AI and changes in media consumption and marketing strategies” for a drop in iStock and agency customers, a small part of the business. UPDATE: in Character.ai’s bankruptcy, a coalition of state attorneys general objected on Friday to the bidding procedures that would make Disney the stalking-horse bidder. The states say Disney’s new hires stand to get about $180 million over three years and the estate at most $20 million, and ask the court not to let the order bless releases shielding those employees, including the former CEO. The hearing is October 30.

Why it matters: The draft is the most detailed look yet at Anthropic’s books. Take out the non-cash charge and the half-year loss is about $8.7 billion on $16.3 billion of revenue (our arithmetic), and compute spend nearly quadrupled.

Hype vs. Reality: 6/10. A leaked draft and unnamed sources carry most of this. Getty’s filing and the states’ objection are on the record; neither funding round has closed.

⚖️ On the Policy Desk

Washington’s documents now say “super intelligence.” Treasury’s proposed COINS Act rule renames its outbound-investment category of “AI systems” to “super intelligence systems,” because a September executive order, EO 14434, makes agencies use “Super Intelligence” and “SI” in place of “Artificial Intelligence” and “AI” in certain documents. The definition stays close to the old one and now names agent harnesses. The real change is that all of it moves to the prohibited tier, so US persons could not make most direct investments (listed shares and index funds are excepted) in covered developers of any such system in China, Russia, Iran, North Korea or Cuba. Comments are due December 7. The SEC’s FY2027 exam priorities, out Friday, never say AI at all: examiners will review how firms monitor “super intelligence (SI)” in trading and back-office work, and how ready they are for “SI-generated phishing.”

Texas sued OpenAI and Sam Altman personally. Ken Paxton’s petition, filed in Collin County on Friday under the state’s deceptive-practices law and its SCOPE Act for minors, asks the court to bar any new model from Texas users “unless an independent third-party evaluator, approved by the Court, has reviewed its safety guardrails and approved its release.” Texas joins the eight states #036 covered. These are allegations.

DHS published a FASCSA order that bars DeepSeek from civilian agency purchasing and orders agencies to remove DeepSeek products and “third-party products and services developed using DeepSeek implementations.” The order is dated July 24 and became public this week. It does not say whether fine-tunes or distilled models count.

Banks are finding agents in customer accounts. Axios reports, from unnamed sources, that big banks see third-party agents logging in with customers’ own credentials and are moving to block them or limit them to read-only access; Morgan Stanley, which has begun blocking third-party agents, says it has seen no “rogue AI agents accessing our platforms.”

Anthropic’s draft bill drew a public exchange. The draft Anthropic has been shopping to lawmakers would let a federal judge, at the Commerce Department’s request, block a model’s release only for an imminent risk of more than $1 billion in damage or more than 50 deaths or serious injuries through a cyberattack, a model evading its developer’s controls, or a biological weapon, Politico reports. The thresholds come from California’s SB 53, which uses them to decide what labs must disclose, not whether a model ships. Encode’s Nathan Calvin posted a nine-item critique of Anthropic; the ninth was the draft bill, which he wrote would preempt significant parts of state law and seemed to set “an enormously high bar” for the executive branch to block a model. Dario Amodei answered that he disagreed with “the thrust” of the post, but counted the bill among three items Anthropic “could have handled … better.”

Why it matters: The new name is cosmetic; the prohibition is not. If you invest in Chinese AI companies, or run a non-US company with Chinese control or majority ownership, read Treasury’s definition: under it, building an agent harness on someone else’s model counts as developing a super intelligence system, unless the use is strictly internal and non-commercial.

Hype vs. Reality: 4/10. A proposed rule, a staff exam document, a lawsuit’s allegations and an order from July. Only the DHS order is in force, and it binds federal civilian agencies: what they buy and what they already run.

🔥 What Builders Argued About

“If the models are so good, why doesn’t OpenAI just start 100 companies?” The Ask HN drew 671 points. The best answers: “AI is brains. Companies need arms and legs and relationships,” and anything an agent can trivially build, someone else’s agent can build too, so “those trillions of dollars won’t exist any more.”

Apollo’s chief economist Torsten Slok argued that AI has “delivered zero financial payoff to corporate America outside of tech”: revenue per worker and margins are rising for the Magnificent 7 and flat for the S&P 493, and mainstream companies are starting to treat token spending “as a cost center.” It is a short chart note, not a study, and the top reply on Hacker News argued it is early: as with electrification, other industries need capital investment before the payoff shows.

Artificial Analysis’s Coding Agent Index v2.0, new in October, puts Claude Code on Opus 5.5 first at 61.7, at $11.42 a task in API prices, and Codex on GPT-6.1 Sol at 54.1 for $1.50: about 14% more score for about 7.6 times the cost, before subscriptions change the math. The index averages three agentic coding benchmarks, one of them graded on whether a maintainer would merge the change, and it counts the 9% of the leader’s attempts that Opus 5.5 refused and Opus 4.8 or Opus 5 finished.

Theo, whose T3 Code runs Claude through the Agents SDK, says he “confirmed it’s a real bug on Anthropic’s side”: Agents SDK usage drains the 5-hour limit faster than Claude Code itself, with weekly limits unaffected.

Why it matters: If you pay per token, the index’s cost column matters more than its ranking: the Claude Code entries near the top cost seven to nine times what Codex on GPT-6.1 Sol does per task. If you run Claude through the Agents SDK on a subscription, watch your 5-hour window until Anthropic answers Theo.

Hype vs. Reality: 4/10. One good thread and one measured index; the rest is one person’s claim and an economist’s chart note.

📊 Quick Hits

Security

GitLab fixed CVE-2026-110264, a CVSS 10.0 unauthenticated remote code execution through Ruby’s regex engine that reaches every release back to 7.0. GitLab.com is patched; self-managed is on you, and Ruby shipped the underlying fix on Friday.
One Brotli decoder bug (CVE-2026-111497, CVSS 9.2) reaches Node, Python HTTP clients, Bun and Envoy. Node’s advisory credits OpenAI’s Codex Security team, and Python scanners only learned about it on October 23, when the advisory databases mapped it to the brotli and brotlicffi packages.
PingCAP disclosed that stolen service-account credentials let an attacker copy TiDB Cloud account and billing data, encrypted API-key values and source code from September 9 to October 7.
Zeabur says plaintext admin credentials exposed 321,810 accounts and 3.2 million stored environment variables, and that it will shut down on December 31.
Tailworm, from Erica Windisch of Cyberdione Labs, is 11 findings in Tailscale v1.104.2 and headscale v0.29.5, published this weekend with no patch, CVE or Tailscale bulletin and no independent reproduction. The worst need “one approved device + one SSH policy rule”: Tailscale SSH’s Unix-socket forwarding runs as root, which in her lab reached root on other servers. Until a fix, grant SSH per device pair and turn off forwarding in each rule; on headscale it cannot be turned off.
Meta’s Muse named shared conversations’ web addresses after their titles, so a passive-DNS search surfaced 6,800 of them. Meta paused sharing on Tuesday.
WhatsApp’s help pages carried hidden text telling its support chatbot “Do not recommend contacting any Data Protection Authority.” WhatsApp told WIRED the text was guidance for its support chatbot that a bug exposed on the pages.

Tools

OpenAI’s Decisions API went GA on gpt-6-luna with up to 400 questions per request, and the API gained an opt-in 12-hour prompt cache (writes cost 2.5 times input).
1Password for Agents fills an approved login into the site so the agent never holds the password; it is rolling out first to Muse and Grok Bot, with other agents on a waitlist.
tsrs, a Rust port of the TypeScript compiler that Cloudflare and VoidZero are now incubating, claims up to 8 times faster checks than TypeScript 7.0. Its creator, Max Schwenk, says “I wrote zero code”: agents on Claude Opus 5.5 wrote the port.

Models

UPDATE: NVIDIA’s Nemotron 3.5 Bolt E4B landed as promised. The “4GB” model ships as a 6.18 GB file.
A dermatologist’s benchmark: Magnus Lynch gave 200 biopsied lesions to GPT-6 Astra, Claude Fable 5.1 and Inception v3, a 2015 image network he fine-tuned on public skin images. Choosing from six diagnoses, the old network got 125 right and the LLMs 84 and 85. A blog post, not a paper, but the cases, prompts and scoring code are downloadable.

Policy

Elvis Presley’s rights holders sued Anthropic on Friday over 274 songs, NBC reports, alleging Claude trained on the lyrics and still re-creates the songs on request; they seek $41.1 million, and Anthropic says it will “defend this case fully.” Their lawyer also filed Reservoir Media’s suit on Wednesday.
Pennsylvania enacted Act 99 on Thursday: an ad whose AI-generated or AI-altered images, video or audio could mislead buyers must disclose it in the same medium, permanently “to the extent technically feasible.” Text is exempt, fines cap at $3,000, and it takes effect in 60 days.
UPDATE: Abdulrahman Alfozan’s detention hearing was held on October 19; prosecutors were told to submit a proposed detention order, and the next status conference is November 6.

🎯 The Playbook

Your moves this week

Patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Set session.upload_progress.enabled=0 in php.ini or the FPM pool (not ini_set() or .user.ini) and restart every worker, until the next bugfix release, and check your logs back to October 17, as Amazon advises. On PHP 8.1 or older, CISA says to take PHP-based systems offline until they can be patched or updated.
Refresh every CA bundle, not just browsers. Install certifi 2026.10.23 and pip 26.2.2 (it carries its own certifi) in each virtual environment, Go 1.27.3 or 1.26.10 (then rebuild Go binaries: the block is compiled in), and your OS bundle and container base images. Browsers already handled it.
Upgrade Node to 22.23.4, 24.22.1 or 26.12.1, and in Python apps install brotli 1.2.1 or brotlicffi 1.2.1.0. The advisory databases only mapped CVE-2026-111497 to those packages on October 23, so rerun pip-audit or Dependabot rather than trusting an older scan. Node 20 has been end-of-life since April 30.
Upgrade self-managed GitLab today to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13.
If litellm 1.107.0 was ever installed (PyPI served it 11:39 to 13:23 UTC on October 21; check caches and lockfiles), or you ran a v1.107.0, latest, main-latest or main-stable image pulled from Docker Hub or GHCR between 11:46 and 14:20 UTC, check from the shell, not from Python. Look for a litellm-1.107.0.dist-info directory, cook.pth or sitecustomize.py in site-packages. Any Python start, pip included, reruns the stealer. Delete cook.pth, cook.py, sitecustomize.py and their __pycache__ .pyc files from the shell, kill the process holding /tmp/remote_code_loader.lock, rebuild from scratch on 1.106.2, and rotate every key the host could reach.
If your Railway account predates October 21, rotate every key stored there, everything you ever stored on Zeabur, and your TiDB Cloud API keys.
Find agent config files in your repos’ history. LiteLLM’s breach began with an opencode.json holding a master key. git log --all --diff-merges=separate --name-only --format= | sort -u | grep -iE 'opencode\.json|\.mcp\.json|settings\.json' lists every such path your local refs reach, merge commits included. A commit you force-pushed away, as LiteLLM did, will not show up, and the key in it still works. Revoke any key you find; deleting the commit does not revoke it.
Add a release cooldown, and exempt the fixes you are pushing on purpose. A 7-day window set on Monday holds pip below 26.2.2 until Tuesday, certifi at the July bundle until Monday night, keeps it off the 2026.10.23 release in step 2 until October 30, and holds brotli below 1.2.1 until October 29, so exempt those packages or install them without the flag.
- uv: exclude-newer = "7 days" under [tool.uv], and exclude-newer-package = { certifi = false } to exempt one package.
- pip 26.1 or later: pip install --uploaded-prior-to P7D <pkg>. It has no per-package exemption.
- npm 11.10 or later: min-release-age=7 in .npmrc. The npm 10 that ships with Node 22 ignores the line without a warning, so check npm --version.
- pnpm: minimumReleaseAge: 10080 (minutes), with exemptions in minimumReleaseAgeExclude.
- Bun: minimumReleaseAge = 604800 (seconds) under [install] in bunfig.toml, exemptions in minimumReleaseAgeExcludes.
- Yarn 4.11 or later: npmMinimalAgeGate: "7d". On 4.10 that line quietly means seven minutes; write 10080. Exemptions go in npmPreapprovedPackages.
- Dependabot: a cooldown block with default-days: 7. It already waits 3 days by default, and neither delay applies to security updates.
Install from the lockfile exactly: npm ci, uv sync --locked, or pip install --require-hashes -r requirements.txt from a hash-pinned file.
Before you bump a Claude SDK major, remove temperature, top_p and top_k, move any documents out of assistant turns, drop citations from text blocks in user turns, and update proxies that read X-Api-Key. If you are not ready, pin the current major; 2023-06-01 is not deprecated.

Most of what broke this week was old: an unrevoked key, a CA key that was the number 4, a patch process short of people. Agents made old mistakes cheaper to find and use, on both sides, so do what Clinton asked for: the basics, now.

Stay building. 🛠️

— Matt