What Is 'Black October'? The 2025 Cyberattack Wave Explained
A surge of breaches hit Railway, Quest Diagnostics, Zeeba, PHP, and more in days. Here's what happened during the "Black October" cluster.
What was Black October?
Black October is the informal name security researchers and developers gave to a dense cluster of cyberattacks and breach disclosures that hit within days of each other in late 2025. The term didn’t come from a company or a government agency. It spread organically on social media as people in security and software communities noticed an unusual pattern: multiple major incidents, often affecting unrelated companies, all surfacing in the same short window, with some posts describing dozens of serious attacks in a 48-hour span.
TL;DR
- Black October refers to a cluster of major breaches and vulnerability disclosures that hit in rapid succession, compressed into days rather than spread across a typical news cycle.
- Confirmed incidents in the cluster included a cloud provider called Zeeba shutting down after an attacker accessed millions of customer records, a poisoned version of LightLLM designed to steal credentials, a breach at developer platform Railway, and a breach at medical testing giant Quest Diagnostics.
- Security firm Rapid7 reported that the average gap between a vulnerability becoming public and attackers starting to exploit it has shrunk to around three days, leaving almost no time for organizations to patch.
- OpenAI CEO Sam Altman argued that AI model capability for finding security flaws is growing exponentially, and that traditional one-bug-at-a-time patching is becoming unworkable.
- Not every incident in the cluster was directly caused by AI; some attacks had been running quietly for months before being discovered, and the clustering partly reflects disclosures catching up with older intrusions.
- A widely shared chart of monthly CVE (Common Vulnerabilities and Exposures) counts showed a sharp, near-vertical spike around the same period, which became a visual shorthand for the “Black October” narrative.
- The practical risk for regular people runs through everyday infrastructure: cloud platforms that host apps, certificate authorities that verify websites, and healthcare companies that store medical records nobody can simply reset like a password.
What specific breaches made up the Black October cluster?
A handful of named incidents anchored the Black October narrative, each illustrating a different kind of exposure:
Zeeba, a cloud company, disclosed that an attacker used leaked internal login credentials, which had been stored without adequate protection, to access roughly 3.2 million records tied to more than 300,000 customer accounts. The company announced it was shutting down in the aftermath.
LightLLM, a tool developers use to connect applications to AI models, had a poisoned package published to it. The malicious version was built to steal passwords and secret keys from anyone who installed it before it was pulled within a couple of hours.
A certificate authority, the type of company that issues the digital certificates proving a website is legitimate, was found using cryptographic keys so weak that one researcher noted a key value was literally the number four.
Railway, a platform widely used by developers to deploy applications, disclosed that an unauthorized party may have accessed encrypted configuration settings stored by customers, and in some cases obtained the decrypted contents, which often include secret keys and passwords to other services. Railway said it believed the intrusion was part of a broader pattern of attacks targeting platform companies specifically to compromise AI services downstream. The company paused deployments and told users to rotate their keys.
Quest Diagnostics, one of the largest medical testing companies in the United States, confirmed that patient data within one of its lab systems had been accessed, with the investigation into scope still ongoing at the time of disclosure.
Beyond these, social media threads tracking the wave listed a long tail of other affected organizations and projects, including SubQuery, IDCF Cloud, TensorLake, Ghost Action, Rank Math Pro, ConnectWise, OpenCode, Nike, OVHcloud, eMudhra, BIND9, Node.js, the Linux kernel, and Capcom, alongside the PHP vulnerabilities and Next.js security disclosures that had already drawn attention days earlier.
Why did so many breaches happen at once?
Part of the answer is mechanical rather than mysterious. Security researcher commentary circulating during the wave pointed out that a lot of older software was effectively protected not by strong design but by the sheer tedium of attacking it. Finding an exploitable flaw in old code often required a human to spend weeks or months reading through it, and most attackers simply didn’t bother.
AI tools change that economics. A model can be prompted to search for vulnerabilities in a codebase and run continuously, at scale, without getting bored or tired. One account summarized the shift bluntly: humans had effectively built a machine that performs unreasonable amounts of work, and that machine erased the main protection a lot of software was relying on. A security write-up referenced during the wave described researchers independently rediscovering the same PHP issue using a frontier AI model with nothing more than a basic prompt asking it to find vulnerabilities.
It’s worth noting the caveat that circulated alongside the panic: not every Black October incident was caused by AI-assisted discovery, and some of the intrusions, including parts of the Zeeba and other breaches, had reportedly been running undetected for months before anyone noticed. Some of the clustering is coincidence, some is old technical debt catching up with companies, and some is AI-accelerated discovery. All three were happening at the same time, which is what made the week feel so chaotic.
Is this connected to Sam Altman’s warning about patching?
Yes, directly. Around the same time the Black October cluster was unfolding, OpenAI CEO Sam Altman gave an interview revisiting what he called the “Anthropic Mythos freakout,” a reference to Anthropic’s Claude Mythos model earlier in 2025, which proved unusually capable at finding security vulnerabilities, including ones that had sat undetected in important code for years. Anthropic restricted access to that model to a small set of partners because of how effective it was.
Altman’s point was that after that initial scare, organizations patched the bugs that were found and then largely moved on, treating it as a one-time event rather than the start of a trend. He argued that was the wrong read: the underlying models kept improving, and capability for finding security flaws is growing on an exponential curve rather than leveling off. His specific warning was that he no longer believes the traditional model of cybersecurity, finding a flaw and patching it one at a time, will keep working. He suggested that defense will need to shift toward using AI systems themselves to build a new kind of protective layer, rather than relying purely on human-driven patch cycles.
Rapid7’s reported figure, that the average time between a vulnerability’s public disclosure and active exploitation has fallen to roughly three days, is the concrete number that backs up Altman’s concern. Three days is not enough time for most organizations to even schedule an internal response, let alone deploy a fix across every affected system.
What does Black October mean for regular internet users?
Most of the company names involved won’t mean much to someone outside software development, but the downstream effects reach ordinary users through infrastructure they never see directly. Railway hosts applications for many other businesses, so a breach there has ripple effects on services built on top of it. A weak certificate authority key undermines the system that lets browsers verify a website is genuine. PHP runs a large share of the web’s backend, so vulnerabilities there are broadly consequential rather than niche.
The Quest Diagnostics breach is the clearest example of stakes that hit individuals directly. Quest serves a large share of hospitals and physicians in the US, and the company confirmed patient data within one of its lab systems was accessed. Unlike a leaked password, which can be reset, or a stolen credit card, which can be cancelled, medical history is permanent. Once that kind of record is exposed, there’s no way to issue a new one.
Frequently Asked Questions
What does “Black October” actually refer to?
It’s an informal, crowd-coined term for a tight cluster of major cyberattacks and vulnerability disclosures that hit in rapid succession in late 2025, rather than an official designation from any security agency or vendor.
Was AI directly responsible for the Black October breaches?
Some of it, not all of it. AI-assisted vulnerability discovery made finding certain flaws, including some in PHP, dramatically cheaper and faster. But security commentary at the time noted that several incidents, including parts of the Zeeba breach, had been ongoing for months before being detected, meaning not every case traces back to AI-driven discovery.
What happened to Railway and why does it matter?
Railway, a platform developers use to deploy applications, disclosed that an attacker may have accessed encrypted customer configuration settings and in some cases obtained the decrypted contents, which often include API keys and passwords. Railway said it believed this was part of a broader campaign targeting platform companies to compromise AI services, paused deployments, and told users to rotate credentials.
How bad was the Quest Diagnostics breach?
Quest Diagnostics, which serves a large portion of US hospitals and physicians for lab testing, confirmed that patient data within one of its lab systems was accessed, with the full scope still under investigation. Medical data breaches are considered especially serious because, unlike passwords or financial accounts, medical history can’t be reset or replaced.
What is a CVE and why did the chart matter?
A CVE (Common Vulnerabilities and Exposures) is the standard identifier assigned to a publicly known security flaw. A chart showing monthly CVE disclosures spiking sharply upward circulated widely during Black October and became a visual symbol of the surge, reinforcing the sense that vulnerability discovery was accelerating faster than organizations could respond.
