The most dangerous response is the one that looks fine.

A security filter, switched off by a name

Black October: from a token bill to a security advisory, and what disclosure really takes.

Colin McNamara · Austin, November 2, 2026

Everything here is public: the advisory, the pull requests, and a lab built on a neutral stub.

follow along

Who’s patched PHP since October 21?

One quarter of 2026 published more CVEs than the first nine months of 2025.

Finding scales with compute. Fixing doesn’t.

Source: CVE Program metrics, cve.org, published CVE records by quarter, updated October 5, 2026. Published records, not discovery dates. Most have no confirmed exploitation yet: that’s the window to fix them.

[0:45] Who's patched PHP since October 21? Ask for hands, no judgment: most of us haven't. Let it sit. Black October was a disclosure wave, not one attack. Several incidents had been running for months and only went public that week. The centerpiece was real: PHP2Shell, found by three teams separately, all with AI in the loop, and someone was already trying it four days before the fix shipped. Finding is getting cheap, for everyone. (Sources: php.net's October 21 security release, Amazon Threat Intelligence, CISA's Known Exploited Vulnerabilities catalog.)
▸ The headline. Read the shape: flat all of last year, then each quarter of this year outran the last.
▸ July to September alone beat the first nine months of 2025. These are published records, not discovery dates. Most have no confirmed exploitation yet; that's the window. And their queue is your queue: curl now handles low and medium reports in public issues because the private queue can't keep up with valid reports.
▸ Say it once and stop: finding scales with compute. Fixing doesn't. That's the thesis of the whole talk.

At work, I was near the top of the Claude Code bill.

That’s where the fixing started.

So I started fixing it. Eight fixes, all merged, and I’m still burning down the rest.

One policy, enforced once, for every app.Me, four weeks ago. Mixture of Models, Austin, October 5, 2026.

October 10. Building a lab to show it off, I found one that wasn’t a bug in my client.

vLLM Semantic Router, which I use and contribute to. GHSA-xr66-pq9r-2c8j, high severity.

[2:35] At work, my Claude Code use put me near the top of the bill. That sent me looking for a router: one place to decide which model answers.
▸ My coding agents went behind vLLM Semantic Router, pointed at models on my own lab, not at work. OpenCode and Codex worked through it on day one.
▸ Claude Code's Anthropic Messages API wasn't fully supported yet.
▸ So I started fixing it. vLLM first, in September, then the router itself. Eight fixes, every one merged. Claude Code mostly works through it now; I'm still burning down the rest.
▸ Somewhere in there this became the most fun I'd had in years, so I joined the router's Data Plane and Networking working group. That put me on the other side of the queue too: now I review. I didn't know yet that the code would be the easy part.

▸ [4:05] Four weeks ago, in this city, I made this promise about routers: put cost, privacy and security at one control point. Tonight is what happened to that promise.

▸ [4:25] October 10. I'd been fixing this router for a month. Building a lab to show it off, with AI in the loop, I found one that wasn't a bug in my client. The AI helped me find it; reading the code is how I knew it was a privilege bypass: a high-severity security bug in the router I use and contribute to. The advisory is public, so everything about the bug is in it.

Same request. Add one header., and the guard is skipped.

1 Two filters share one name. 2 Istio files its per-route settings under that name. 3 So your filter’s call goes to the endpoint picker, and the guard is never called.

One policy, enforced once, only counts if the request reaches it.

Recorded in a lab with a neutral stub guard, Istio 1.28.0, October 18, 2026.

Recorded lab, Istio 1.28.0, captured October 18, 2026 (excerpt)

[A] collision: stub under the bare name
  control (non-pool)   marked=y  -> HTTP 403
  pool (large-model)   marked=n  -> HTTP 200
  pool (large-model)   marked=y  -> HTTP 200

[B] rename: stub under envoy.filters.http.ext_proc.stub
  pool (large-model)   marked=y  -> HTTP 403
  pool (large-model)   marked=n  -> HTTP 200

[5:10] Here's the bug; no live demo needed. Two roles first: the guard enforces your policy, and the endpoint picker chooses which model server gets the request. This is the gateway's filter chain: the router's filter, then Istio's, then the Envoy router and the pods.
▸ First run, a request the guard should stop: the router's filter asks the guard, 403.
▸ Now the same request with one routing header, which any client can set. Ask the room: 403 or 200? Let them answer.
▸ When the gateway routes on it, it lands on an InferencePool route. Istio files that pool's per-route settings under a filter name, and the router's filter has the same name, so the settings reach both: both names light up.
▸ Run it: the router's filter calls the endpoint picker instead of the guard. There's the 200 from the start: waved through, and the guard never hears about it. No error, and not a line in the guard's log. This is a real lab run from October 18 with a neutral stub guard; R shows the capture.
▸ Last line, slowly: one policy, enforced once, only counts if the request reaches it.

How it got in: every step made sense on its own.

The fix: give the router’s filter its own name. Check yours: look for the name twice in the gateway’s config.

That felt like the end of the story. It was the middle.

Sources: each project’s public pull requests; the analyze warning is proposed in istio/istio#62560. When it became reachable is my reading of the history.

[7:40] How did this get in? Nobody wrote a bug.
▸ In March 2025 an inference extension chart used the bare filter name, and the router did the same in plain Envoy; harmless then. In July, Istio started filing per-route settings under that name, shipping in 1.27.
▸ That fall the router's Istio setup used the bare name and a client header could pick the pool: that's when it became reachable.
▸ In March the chart renamed its filter as a routine fix; there was no channel to share the lesson, and that's a gap in all of our processes. October 10, I found it. Every step made sense where it was made. Flat names, settings keyed by name, and no shared check for collisions: that's a class, not anyone's mistake.
▸ The fix: same filter type, its own instance name. The rename is small; validating it and rolling it out is the work. Check yours: look for the name twice in the gateway's config; an analyze warning for this is in review in Istio.
▸ That felt like the end of the story. It was the middle.

My own AI tools locked me out.

Defenders need capable models they control.

The door I knew of asked for an assigned CVE or a security-research employer. Anthropic’s Cyber Verification Program is wider now: maintainers and individual researchers can apply.

[9:35] Here's a part I didn't expect. Claude Code, the assistant I use every day, locked me out, more than once. Anthropic's safety classifier stopped the reproduction, the disclosure handoff, even an explainer of the bug. Reviewing the fix was fine; it's the reproduction and the attack path it won't touch. (Optional, if the room is warm: it stopped me partway through building this talk, too.) From the outside, defending looks a lot like attacking, and its defaults make sense.
▸ So I went local: Qwen 3.8 27B, an open-weight model on my own GH200, ran the reproduction, wrote the patches and helped guide the disclosure.
▸ Lesson: defenders need capable models they control.
▸ There was a door, but when I needed it, it asked for an assigned CVE or a security-research employer. Mine was requested October 18 and is still pending. It's wider now: Anthropic's Cyber Verification Program lets maintainers and individual researchers apply. That's the system starting to catch up.

The fix came with the report. Six days to a public advisory.

MergedOctober 18Releaseup nextDeployedup to you

No need to wait for the release: rename the filter in your gateway, or run main.

Fixed in one project. The same pattern was running in others.

Then I had to find people.

Every one of these is a manual handoff, running at human speed.

Writing the fix took less time than writing the messages.

The best handoffs happened in a hallway.

A security handoff shouldn’t depend on being in the same hallway.

[11:55] The rename fixed the router, and the advisory was public. But the same pattern was running in other projects. Upstream, I opened an Istio issue and a pull request for an analyzer warning that catches two filters sharing the name, and a docs pull request in the Gateway API Inference Extension with naming guidance, so the next project doesn't repeat it. Both are in review. Then I searched GitHub for other projects using the same filter name in their own Istio integrations.
▸ Then I had to find people. That's the part nobody budgets for. I sent private notices to the projects it touched, and finding the right person was the work. Security contacts that bounce. Projects with no private way to report. Maintainers you can reach only by guesswork. Volunteers with no time left to answer. None of this is anyone being bad at their job: a lot of these projects run on volunteers, and the process was built for a slower world. Private notices stay private.
▸ Writing the fix took less time than writing the messages. Three AI models reviewed every message, and every send and every commit was still mine. I kept wishing there was one place to send this, once, and have it reach everyone who needed it. Finding got faster this year. The handoffs didn't.

▸ [13:15] What worked best was a hallway. I was at PyTorch Conference and AGNTCon that week, and I spent a good part of it hunting people down in person. GrokBot helped me pick sessions and organize my schedule, and cross-referenced my list against the exhibitors and speakers, and I found engineering leaders on site, several of whom led the teams that shipped fixes on their side. A security handoff shouldn't depend on being in the same hallway.

Where the time went, in my own case.

Finding took a day. The handoffs took two weeks of nights and weekends.

Dates from the public advisory and my notes.

How do we solve this?

Sources: CVE Program metrics, published CVE records, Q3 2026 against Q3 2025 (cve.org); GitHub changelog, October 1, 2026: rate limits for private vulnerability reports.

What it would take, and who’s on it.

Nobody has the whole thing yet.

[14:45] So how do we solve this? Two months ago I knew reviewers were underwater. What I didn't understand was how tangled this generation of software is: one filter name crossed three projects, and fixing it meant coordinating across all of them. I have a lot more empathy now for the people doing remediation every day. Step back from my one bug. AI-driven development is a flood of code to review, and the people reviewing it are maintainers, most of them volunteers. Three times the published CVEs of a year ago: that's the chart from the start.
▸ Vulnerability reports are part of that flood: GitHub now rate-limits private vulnerability reports, and curl moved low and medium reports into public issues.
▸ Attackers move at agentic speed. We still pass emails and triage like it's 2008.

▸ [15:55] What would it take, and who's on it? Three things. Communication: automated handoffs, so the right person gets a report and its status in seconds, not days. Remediation: software factories, running vulnerability work through the same pipeline we already run features through, automated fixes and backports with a person approving each one. And people: paying the ones who maintain it.
▸ Who's working on each? On communication, SAFE at OSAIA is one corner: members sharing AI incident findings and turning them into shared controls; what I want to bring there is the handoff. OpenSSF has disclosure guidance, and OSV, CSAF and VEX, and CVE Services make advisories machines can read. On remediation, OSS-Fuzz and CodeMender propose fixes that maintainers review, OpenSSF's OSS-CRS runs AI find-and-fix systems together, and the Linux Foundation's Akrites is building shared responders for confidential fixes. On people, Alpha-Omega, the Sovereign Tech Agency and GitHub's Secure Open Source Fund pay the people who maintain it.
▸ Nobody has the whole thing yet. The gaps between the pieces are still email.

Black October is only the start.

October was the first month of a quarter nobody has counted yet.

Finding already scales with compute. Now fixing has to.

Let’s get good at this, fast.

What are you seeing?

GHSA-xr66-pq9r-2c8j · gateway-api-inference-extension#3078 · istio/istio#62556 · istio/istio#62560

Colin McNamara · colinmcnamara.com/connect · linkedin.com/in/colinmcnamara · github.com/colinmcnamara

stay in touch

[17:30] Remember the chart from the start? Black October was the first month of a quarter nobody has counted yet. It's only the start. This is something we all need to get really good at, quickly. Three things this week, one for each piece. Communication: be reachable. Turn on private vulnerability reporting, and keep a security contact that answers. Turning it on takes minutes; answering is the part that needs support, and it's the difference between a report bouncing and landing. The router had private reporting turned on, and that's where this story went right.
▸ Remediation: bring the fix. Finding is getting cheaper; anyone with a model can file a report, and validating one still takes real expertise. Don't stop at the report: offer a fix, or help test one. I sent the patch with mine, and that let the maintainers move fast. And if you run this stack, look for the name twice and rename it in your gateway.
▸ People: show up for the maintainers. They're carrying this flood, and we owe them time, funding and better handoffs. Review and backtest in the projects you use; not a flood of AI pull requests, that's more load, not less. I started this with a bill I wanted to cut; here's the one we haven't paid. Twenty percent time for a slice of your engineers, and fund the foundations. All of this costs money. So does the next PHP2Shell.

▸ [18:45] Finding already scales with compute. Now fixing has to. Let's get good at this, fast. Stop, and let it sit. Then: what are you seeing? Who else is working on this? The code is how to reach me and stay in touch. Open the floor. Q&A notes: if asked about a CVE, one was requested on October 18 and is pending; the next release carries the fix. If asked why Istio doesn't rename its filter: EnvoyFilters that match Istio's filter by name today could change behavior, so it's a separate issue; the reasoning is in the public issue. If asked whether you're exposed: run the check. If asked about AI pull requests, since your own fixes were AI-assisted: mine were small, disclosed as AI-assisted under the project's rules, and I stayed through review.