1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.

2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.

3. California: data on every public school student since 2023 stolen, including disability status.

4. Railway: hackers stole customers’ secret keys from a hosting platform used by millions of developers.

5. Zeabur: 321,810 accounts breached. The company is shutting down.

6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer.

7. GitLab: a 10-out-of-10 severity hole in every version since 2014.

8. Carn: criminals used an AI hacking tool to break into 100+ companies.

9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline.

10. Onamae: malware planted on up to 26,739 customer servers in Japan.

11. Signal: a bug could leave your mic and camera on after you hang up.

12. NGINX: 3 critical holes in software running ~1/3 of websites.

13. HTTP/3: a single connection can crash 7 of the 10 web server types tested.

14. Plex: hackers breaking into home media servers.

15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations.

16. Palo Alto: ransomware gangs breaking in through company firewalls.

17. Bullhorn: platform used by 10,000+ companies knocked offline.

18. Medi-Cal: 970,000 patients’ data stolen.

19. WordPress: hackers stole a plugin maker’s keys and used them to plant backdoors on websites.

20. AOMEI: backup software’s update server handed out a backdoor.

21. Meta Muse: Meta’s AI agent exposed users’ personal and business secrets.

22. Tor: 333 relays hijacked to steal logins.

23. TiDB Cloud: database company’s cloud breached.

24. State Bank of India: India’s biggest bank confirms a data breach.

25. OVHcloud: hackers slipped a password stealer into a cloud company’s official tool.

26. Siemens: a software hole being used to spread malware.

27. North Korea: state hackers launch a new attack campaign on South Korea.

This is not unexpected. Human programming is about as good on security as hand made stuff was good on precision--until machines got involved.

This creates another unique period in time where those who understand AI will be shooting fish in a barrel and making large gains in their chosen field, until best practices catches up.

Those responsible for cyber security had a good six months now to use AI to find the problems. If they took it casually then, they've got a fire under them now.