The AI Bug Apocalypse Has Officially Started

Author: Better Stack · Watch on YouTube

Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.

Original language: English

Original video: The AI Bug Apocalypse Has Officially Started · Channel: Better Stack · 08:48 · Watch on YouTube

Topics: Cybersecurity and software security, Open source and software ecosystems

Summary

A Trend Micro Zero Day Initiative accidentally sent Linux kernel vulnerability reports to a public mailing list, exposing unpatched bugs, including two high-severity SMB flaws that could enable remote code execution. The incident comes amid a wider wave of disclosures dubbed “Black October,” including serious PHP vulnerabilities and other security issues. The video argues that AI is accelerating bug discovery, shifting the bottleneck from finding flaws to triaging, fixing, and shipping patches, while also helping attackers exploit published fixes more quickly. Organizations should treat patching as a continuous process, prioritize internet-exposed systems, automate updates where possible, and replace software that can no longer be patched.

Key points

On October 22, vulnerability reports intended for Linux’s private security list were mistakenly posted to the public kernel mailing list.
Two exposed kernel SMB bugs were rated 9.0 on the CVSS scale and could lead to remote code execution.
The reports also included local privilege escalation bugs and an information leak; some patches were queued, but the bugs were not yet fixed when the list was published.
Kernel maintainers have warned that AI-assisted bug reports are increasing sharply, sometimes duplicating findings.
The video describes “Black October” as largely a disclosure wave rather than a wave of active attacks, noting that many bugs had been found earlier.
AI-driven vulnerability discovery may create surges of urgent updates across open-source, commercial, and SaaS software.
As finding bugs becomes faster, triaging, fixing, and shipping patches becomes the main bottleneck.
Attackers can study published patches to identify the changed code, shortening the time between a fix and a potential exploit.
The recommended response is continuous patching, prioritizing internet-facing systems, automating updates where possible, and replacing unpatchable software.
For the week covered, the video recommends updating PHP, watching for Linux kernel SMB fixes, unloading KSMBD if unused, and updating GitLab and Node.js.

Chapters

Start	Chapter	Summary

Quotes

they landed on the public Linux kernel mailing list where anyone in the world can read them. — 00:00

Linus Torvalds called it almost entirely unmanageable — 03:04

we’re going to get surges of urgent updates across the whole stack — 05:10

Finding bugs used to be the slow and expensive part, but now it’s cheap. — 06:12

treat patching as something that runs all the time rather than a thing you do once in a quarter. — 07:43

Concepts and entities

Zero Day Initiative, Linux kernel, SMB, WannaCry, Black October, PHP, National Cyber Security Centre, Mythos, Chrome, KSMBD

Full transcript (original language)

00:00 On October 22nd, Trend Micro’s Zero Day Initiative sent a batch of Linux kernel vulnerability reports to the wrong mailing list. Instead of going to the private security list where bugs are supposed to stay quiet until a fix is ready, they landed on the public Linux kernel mailing list where anyone in the world can read them. Two of those bugs are rated 9.0 out of 10 on the CVSS severity scale, and both of them can lead to remote code execution. And as

00:30 wild as that is, this isn’t even the biggest security story of the week. This is the same week that two flaws in PHP pushed governments and companies to pull their websites offline, and people in the security community have started calling this whole stretch Black October. There’s a lot to cover, so let’s dive into it. So, on October 22nd, Phoronix reported that Trend Micro’s Zero Day Initiative sent several vulnerability reports to

01:01 the public Linux kernel mailing list instead of the private security list. Greg Kroah-Hartman, who is basically the second in command of Linux, replied to every one of them asking Zero Day Initiative why it had sent them to the public list. Security researchers normally keep a bug private until there is a fix, and these bugs weren’t patched yet. So, it looks like Zero Day Initiative simply sent them to the wrong list by mistake rather than going public on purpose. And there are a bunch of vulnerabilities in that list, but the

01:31 worst two are in the kernel’s SMB code. SMB, which stands for server message block, is the protocol computers use to share files and folders over a network. So, that is what’s running when you open a shared drive at an office or connect to a network-attached storage at home. The reason SMB bugs are so dangerous is that an SMB server’s whole job is to accept and process data coming in from other machines over the network. So, a bug in that code can be reachable by someone who has never logged into that

02:03 machine. And if that sounds familiar, it’s because the WannaCry ransomware outbreak back in 2017 spread exactly like that through a bug in Windows’ SMB implementation. And the first bug in this list is a remote code execution bug in SMB Direct caused by an integer underflow, which is when a number drops below zero in a type that can’t go negative and wraps around to a huge value. So, the code ends up copying far more data than the buffer can hold. And the second one is a race condition in

02:33 the KSMBD, the SMB server built into the kernel, where two threads touch the same data in an order nobody planned for. Both of them are rated at a 9.0 severity score, and the rest of the bugs in the list are local privilege escalation bugs in the networking stack and the VMware graphics driver. Plus, there’s also an information leak in the NVMe target code. So, when For Honor published the list, none of these bugs were fixed yet, although some had patches queued up. So, this is probably already very stressful

03:04 if it’s going out on a Friday, and this is sadly the new reality we’re living in. And to be fair, kernel maintainers have seen this coming for a while now. In March, Willy Tarreau said that regular security lists went from two to three reports a week to five to 10 reports a day. And in May, Linus Torvalds called it almost entirely unmanageable because different people were running the same AI tools on the same code and filing the same bugs. And one of this week’s leaked bugs had actually been reported by someone else a

03:36 week earlier. And the kernel docs now say that AI-found bugs should be reported publicly because, as Linus puts it, they’re pretty much, by definition, not secret. Now, we don’t actually know whether Zero Day Initiative used AI to find these particular bugs, but the timing is interesting because the kernel project itself is now saying that AI-found bugs shouldn’t be kept secret at all. So, even though this leak was most likely an accident, it fits where the kernel’s own rules are already heading. But in general, this has not

04:07 been a good month for cybersecurity. Arguably, the worst bug of this whole Black October has been the PHP 2 shell, which James already did a highly detailed video about, so go check that out for more information. And that was only one item in a very crowded week. There was also the eMudhra certificate mess that I covered in my last video, a CVSS 10 GitLab bug going back to 2014, a remote code execution fix in Node.js, and an Axios report about unauthorized AI agents showing up inside US bank

04:40 accounts. Now, before we start panicking, it’s worth saying that a lot of Black October has been a disclosure wave rather than an attack wave. Many of these bugs were found weeks or months ago, and they simply went public in the same few days. And OpenAI says that to its knowledge, AI found the PHP bugs before attackers did. And so far, most organizations seem to have patched it in time. But this week is also a preview of what security is going to look like from now on, so let’s talk about where that

05:10 is heading. So, back in May, the UK’s National Cyber Security Centre warned organizations to get ready for what is called a vulnerability patch wave. The idea is that every company and every project carries years of technical debt, and AI is now good enough to dig through all of that at once. So, instead of a steady trickle of patches, we’re going to get surges of urgent updates across the whole stack, from open source to commercial software to SaaS products. And we can already see this in the

05:41 numbers. According to internal documents reported by ProPublica, and Prophecy’s Mythos model found 90 critical and 141 important bugs in SharePoint alone in April, which was faster than Microsoft could fix them. And Microsoft’s July Patch Tuesday went on to ship fixes for more than 600 bugs. Over at Google, Chrome 149 and 150 fixed 1,072 security bugs, which is more than the previous 23

06:12 Chrome releases combined. And one of them was a sandbox escape that has been sitting in the code for over 13 years. Google is now even testing security updates twice a week because of this. So, what this means is that now we have a new bottleneck. Finding bugs used to be the slow and expensive part, but now it’s cheap. So, now the hard part is triaging, fixing, and shipping patches fast enough. And that’s exactly what’s breaking the Linux security list right now, and that’s why AI companies have

06:42 started funding security audits of open source projects like the OpenAI funded audit that turned up PHP to shell. And at the same time, attackers have the same access to the same models, and every published patch shows them exactly which code changed. So, the window between a fix going out and an exploit showing up keeps getting shorter and shorter. And there’s also a new attack surface forming around AI agents themselves. The bank story from Axios is a good example of this because banks can’t always tell whether an agent

07:13 inside a customer’s account is acting for that customer or doing something else. So, most of them are moving towards letting agents read account information without letting them take any actions. But the hopeful thing is that the defenders have the same access and the same tools. And Google’s Chrome security team told Wired that for a mature product like Chrome, new findings start to drop off once most of the bugs that AI can find have been fixed. So, the flood might eventually settle down

07:43 at least for the software that keeps up with it. So, the practical takeaway is to treat patching as something that runs all the time rather than a thing you do once in a quarter. The NCSC recommends having a policy to update by default and start with whatever is exposed to the internet. So, take an honest look at what’s running on your servers and automate updates wherever you can and do plan to replace everything that can’t be patched anymore. And for this week specifically, update PHP, watch for the kernels SMB fixes, and unload KSMBD if

08:17 you don’t use it, and update GitLab and Node.js while you’re at it. So, basically the gist is there’s a lot of things you need to update. So, is AI bug hunting going to make software safer in the long run or are we heading into a permanent state of emergency with endless patching and heightened security? What do you think? Let me know your thoughts in the comments section down below. And folks, if you like these types of technical breakdowns, please let me know by smashing that like button underneath the video. And also, don’t forget to subscribe to our channel. This

08:48 has been Andras from Better Stack, and I’ll see you in the next videos. Stay safe out there. >> [music] [music]