Breaking Points & Yahoo Finance Lying About "Black October", AI Hacks & "Experts"
Internet of Bugs 14:27
75,787 views · 3,671 likes Watch on YouTube ↗
The media and AI companies are calling it "Black October" and the "worst cybersecurity incident in history." But is 70% of the internet actually at risk, or is this just fearmongering designed to sell ads and inflate AI valuations?
Here's a hint: the story is based on a tweet from an anonymous meme account.
In this video, veteran software professional Carl from @InternetOfBugs breaks down the facts: what the PHP vulnerability actually is, why nobody has actually been hacked by it, the real story behind eMudhra and Railway, and why cybersecurity hype is distracting us from the actual threats.
If you found this breakdown helpful, don't forget to like, subscribe, and share with anyone who fell for the panic!
🔗 Links & Resources:
• Website: https://InternetOfBugs.com
• Free Substack: https://internetofbugs.substack.com/
• Support on Patreon (Exclusive videos & weekly Q&A): https://www.patreon.com/c/InternetOfBugs
// Media fearmongering
https://www.youtube.com/watch?v=vZD4PmureWM
https://www.youtube.com/watch?v=2Ze6he-3F74
https://www.youtube.com/watch?v=6miTANTPUSA
// SNL UK much needed levity
https://www.tiktok.com/t/ZPLAth2KL/
// Substack essay about this
https://internetofbugs.substack.com/p/ai-isnt-better-at-hacking-its-just
// This PHP Bug
https://www.php2shell.com
// Other PHP bugs
https://app.opencve.io/cve/?q=vendor%3Aphp+AND+%28cvss30%3E%3D9+OR+cvss31%3E%3D9+OR+cvss40%3E%3D9%29+AND+created%3E%3D2006-11-01
https://app.opencve.io/cve/CVE-2024-4577
// PHP Bug from last century
https://app.opencve.io/cve/CVE-1999-0058
// No evidence of any successful PHP hacks for these bugs
https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/
// A PHP Bug that actually hacked people
https://x.com/censysio/status/1800989855192658413
// The media being silent on that hack
https://www.google.com/search?q=PHP+hack+CVE-2024-4577&tbs=cdr:1,cd_min:6/9/2024,cd_max:6/16/2024
https://www.youtube.com/playlist?list=PLR1VVi2S5xz_HpeJDM2dZ8wgLOd3ZF9Wv
https://www.youtube.com/playlist?list=PLR1VVi2S5xz_jUxCriebQmrOYT0E4qD0f
https://www.youtube.com/playlist?list=PLR1VVi2S5xz94hq2bhREEKPaeVOFzkNf9
https://www.youtube.com/playlist?list=PLR1VVi2S5xz_6aEOkCcGA7qUy9fxl6N6y
https://www.youtube.com/playlist?list=PLR1VVi2S5xz-F74BoHgFB0FFQIFfAYKCI
// Most US cities, like most PHP websites, are tiny with almost no traffic
https://www.census.gov/library/stories/2020/05/america-a-nation-of-small-towns.html
// TLS security failure
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/JESKy8XoAgAJ
https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11
// OpenAI's propaganda
https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
// Railway stores customer keys insecurely
https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html
// The non-AI GitLab bug
https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
// "Agents found in Banks" were given access by bank customers
https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access
// OpenAI positioning itself to cash in on its own fearmongering
https://fortune.com/2026/10/22/php-security-flaw-ai-powered-attacks-hackers-openai-daybreak/
https://www.axios.com/2026/08/06/openai-hugging-face-black-hat
00:00 - The "Black October" Media Panic
01:18 - Introduction: The Internet of Bugs
01:39 - What is PHP and What Was Actually Found?
02:22 - Lab Exploit vs. Real-World Risk
03:39 - 142 Critical Bugs: Historical Context You Weren't Given
04:40 - Real Vulnerabilities the Media Ignored (CVE-2024-4577)
05:21 - The Reality of PHP's 25-Year Security Record
06:04 - Why the "70% of the Internet" Stat is Misleading
07:19 - Pushing Back on Pundits & Media Cluelessness
07:54 - What Really Happened with eMudhra & Railway
09:53 - The Real AI Threats to Cybersecurity
11:45 - The Locksmith Analogy: AI Hacking vs. Human Pros
12:21 - The Real Problem: Corporate MBAs & Cheap Security
14:14 - Final Thoughts & Conclusion
#Cybersecurity #AI #Programming #PHP #InternetOfBugs
Here's a hint: the story is based on a tweet from an anonymous meme account.
In this video, veteran software professional Carl from @InternetOfBugs breaks down the facts: what the PHP vulnerability actually is, why nobody has actually been hacked by it, the real story behind eMudhra and Railway, and why cybersecurity hype is distracting us from the actual threats.
If you found this breakdown helpful, don't forget to like, subscribe, and share with anyone who fell for the panic!
🔗 Links & Resources:
• Website: https://InternetOfBugs.com
• Free Substack: https://internetofbugs.substack.com/
• Support on Patreon (Exclusive videos & weekly Q&A): https://www.patreon.com/c/InternetOfBugs
// Media fearmongering
https://www.youtube.com/watch?v=vZD4PmureWM
https://www.youtube.com/watch?v=2Ze6he-3F74
https://www.youtube.com/watch?v=6miTANTPUSA
// SNL UK much needed levity
https://www.tiktok.com/t/ZPLAth2KL/
// Substack essay about this
https://internetofbugs.substack.com/p/ai-isnt-better-at-hacking-its-just
// This PHP Bug
https://www.php2shell.com
// Other PHP bugs
https://app.opencve.io/cve/?q=vendor%3Aphp+AND+%28cvss30%3E%3D9+OR+cvss31%3E%3D9+OR+cvss40%3E%3D9%29+AND+created%3E%3D2006-11-01
https://app.opencve.io/cve/CVE-2024-4577
// PHP Bug from last century
https://app.opencve.io/cve/CVE-1999-0058
// No evidence of any successful PHP hacks for these bugs
https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/
// A PHP Bug that actually hacked people
https://x.com/censysio/status/1800989855192658413
// The media being silent on that hack
https://www.google.com/search?q=PHP+hack+CVE-2024-4577&tbs=cdr:1,cd_min:6/9/2024,cd_max:6/16/2024
https://www.youtube.com/playlist?list=PLR1VVi2S5xz_HpeJDM2dZ8wgLOd3ZF9Wv
https://www.youtube.com/playlist?list=PLR1VVi2S5xz_jUxCriebQmrOYT0E4qD0f
https://www.youtube.com/playlist?list=PLR1VVi2S5xz94hq2bhREEKPaeVOFzkNf9
https://www.youtube.com/playlist?list=PLR1VVi2S5xz_6aEOkCcGA7qUy9fxl6N6y
https://www.youtube.com/playlist?list=PLR1VVi2S5xz-F74BoHgFB0FFQIFfAYKCI
// Most US cities, like most PHP websites, are tiny with almost no traffic
https://www.census.gov/library/stories/2020/05/america-a-nation-of-small-towns.html
// TLS security failure
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/JESKy8XoAgAJ
https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11
// OpenAI's propaganda
https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
// Railway stores customer keys insecurely
https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html
// The non-AI GitLab bug
https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
// "Agents found in Banks" were given access by bank customers
https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access
// OpenAI positioning itself to cash in on its own fearmongering
https://fortune.com/2026/10/22/php-security-flaw-ai-powered-attacks-hackers-openai-daybreak/
https://www.axios.com/2026/08/06/openai-hugging-face-black-hat
00:00 - The "Black October" Media Panic
01:18 - Introduction: The Internet of Bugs
01:39 - What is PHP and What Was Actually Found?
02:22 - Lab Exploit vs. Real-World Risk
03:39 - 142 Critical Bugs: Historical Context You Weren't Given
04:40 - Real Vulnerabilities the Media Ignored (CVE-2024-4577)
05:21 - The Reality of PHP's 25-Year Security Record
06:04 - Why the "70% of the Internet" Stat is Misleading
07:19 - Pushing Back on Pundits & Media Cluelessness
07:54 - What Really Happened with eMudhra & Railway
09:53 - The Real AI Threats to Cybersecurity
11:45 - The Locksmith Analogy: AI Hacking vs. Human Pros
12:21 - The Real Problem: Corporate MBAs & Cheap Security
14:14 - Final Thoughts & Conclusion
#Cybersecurity #AI #Programming #PHP #InternetOfBugs
Category (YouTube): Science & Technology
Playback is via YouTube's official embedded player. Data from YouTube; Exumo is not affiliated with YouTube.