Peter Guagenti retweeted
New in CodeRabbit Secure:
Deep Scan now follows a vulnerability across your linked repos, then replays the exploit in a throwaway sandbox to prove it's real before it flags anything.
Hendrik walks through this and everything else in the new update:
Peter Guagenti retweeted
Can't say it loud enough...
CodeRabbit Secure is running GPT CYBER MODELS + an ensemble of models to help secure your codebases.
And the first $1,000,000 of scans are FREE.
Secure your applications and services right now. 🙏 Couple clicks and you will thank yourself (and maybe freak out a bit...it's scary good)
CodeRabbit is joining the OpenAI Daybreak Defense Network.
CodeRabbit Secure now runs on GPT-6.1 Sol and OpenAI's GPT Cyber models. Early users have already found and fixed broken access controls and authentication failures with it.
Deep Scan is free until Nov 8, run it on your repo and see what it turns up.
@OpenAIDevs
coderabbit.ai/blog/one-milli…
Incredibly proud to be added to the list of defenders!
CodeRabbit is joining the OpenAI Daybreak Defense Network.
CodeRabbit Secure now runs on GPT-6.1 Sol and OpenAI's GPT Cyber models. Early users have already found and fixed broken access controls and authentication failures with it.
Deep Scan is free until Nov 8, run it on your repo and see what it turns up.
@OpenAIDevs
coderabbit.ai/blog/one-milli…
It's remarkable to me how many unaddressed vulnerabilities still remain in many companies' codebases. There are no more excuses to not finding and fixing these issues immediately. Go do it for free today.
Over the last 30 days, CodeRabbit Secure found 8,000+ high or critical security vulnerabilities across 600 organizations.
Broken access control, SQL injection, and authentication failures were the dominant issues accounting for over 70% of vulnerabilities.
Find and fix your vulnerabilities with CodeRabbit, for free, until November 8th.
coderabbit.ai/security/free-…
Peter Guagenti retweeted
3% of “critical” software security bugs, in all of recorded history, have been found in the last month.
This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total
Do you realize how fucking insane that is?
Peter Guagenti retweeted
"You know those scenes in financial movies like Margin Call where someone realizes that they're all fucked, and no one else sees it yet? And that person feels like they're crazy, and then suddenly everyone is pulling an all-nighter in a boardroom and freaking out? Yeah, that's kind of how this is feeling right now in the SF/Bay Area/AI circles."
#take9
#CyberCivilDefense
# Black October
For anyone who knows me even somewhat well, it's clear that I am a 99th percentile tech optimist. However, the vibes have shifted for me quite a bit in the last 18 hours, and I feel a moral imperative to share what I'm thinking and feeling with my circles so that everyone can understand, and hopefully take seriously, what's happening right now. I think October 2026 will have many chapters written about it in the history books.
You know those scenes in financial movies like Margin Call where someone realizes that they're all fucked, and no one else sees it yet? And that person feels like they're crazy, and then suddenly everyone is pulling an all-nighter in a boardroom and freaking out? Yeah, that's kind of how this is feeling right now in the SF/Bay Area/AI circles.
We're 48 hours into what is being called Black October. In the last 2 days there have been several dozen cyber attacks which, in isolation, would each have been the worst to happen in an entire calendar year. Every sector from government to education to big tech and banks is being massively affected, and people are starting to freak out.
In a nutshell, what's happened is that frontier AI models have gotten to a point where they are as advanced as the most sophisticated programmers, with one critical difference: they can work 24/7, and you can spin up 10,000 of them with a single command and they'll work together tirelessly until they accomplish their task. The most advanced models today are from companies like Anthropic and OpenAI, whose current best technology is so good that they haven't been able to roll it out to everyone yet because of the national security risks it poses.
Meanwhile, the best open source models (where anyone can just download the model weights and do whatever they want with them, uncensored) are slightly behind the frontier but still 90-95% as capable. These models, developed primarily in China, are being used by black hat hackers to wreak havoc on the Western capitalist structure. Presumably, this has been part of China's plan the entire time, and we're seeing its implications fall out in real time.
In red-pilled AI circles, we've been sharing and reading papers called things like "Situational Awareness" and "AI 2027" for the last year or so, which at the time felt a bit like near-term speculative fiction. They laid out the case for why Artificial General Intelligence (AI smarter than any human at any knowledge task) and Recursive Self-Improvement (models that are able to use themselves to get better) weren't half-baked future ideas anymore, but instead an inevitable outcome of the linear progress that's happening.
These papers would then talk about things like "takeoff scenarios," trying to envision how that moment would come to be and what it would be like when it happened. It would either be a "slow takeoff" that would play out over the course of months and quarters, happening subtly and only obvious to a few. Or, it would be a "fast takeoff" where it would pretty much happen instantly, like a bit flipping from 0 to 1.
From everything that I can see and am feeling, we are currently experiencing the fast takeoff scenario. Beyond the crazy security vulnerabilities that have come out recently, there have also been massive breakthroughs in life sciences, fundamental computer science, materials science, and pure mathematics that have all landed in the same time frame. While I still firmly believe that AI will be a net positive for humanity, it's more clear to me than ever that the societal and individual risk is very real, and is playing out NOW.
For as much conviction as I have that this is happening, the thing that's caused me to lose sleep is that I don't really know what to do about it, or more importantly, what to tell you, reader, to do about it. So, the best I can do is make a few suggestions that have always been a good idea but are more timely now than ever:
Set up 2-factor authentication for everything. I use Duo.
Use a password manager across your devices. I use 1Password.
Get an identity protection app set up. I use Alta.
Move your IoT devices to their own network. Claude helped me do this.
And last, but certainly not least, if you've been avoiding leaning into AI, see this as a catalyst to wake up and start using it. Don't just use the chat mode version of ChatGPT/Claude; click that Code/Work button and see how easily you can have AI write code to help you with your job. One of the biggest vulnerabilities was in a massively popular programming language called PHP, and the prompt that set it off was literally, "Find vulnerabilities in php."
This is an unprecedented time for humanity, but as we've done with many things before, we will prevail so long as we are kind, loving, and open-minded to the world.
Much love.
We're in a very scary moment right now. The power of models to crack code has been fully exploited by bad actors all over the world, and anyone with a credit card can now target any company of interest. So @coderabbitai is putting up our own money to help protect our community.
Attackers are using AI to find the holes in your code. We’ll help you find and fix them first, for free.
Through November 8, $1,000,000 in Deep Scan usage is on us.
Current users, former users, teams who've never touched us.
First come first served.
coderabbit.ai/blog/one-milli…
Peter Guagenti retweeted
CodeRabbit is a SpaceX Super Intelligence Launch Partner! @SpaceXSI
Now in the Grok Build Plugin Marketplace: build with Grok Build and independently review changes with CodeRabbit.
Read the announcement coderabbit.ai/blog/coderabbi…
Peter Guagenti retweeted
I spent last night watching my honeypot server get hit 14,000 times in six hours.
And almost none of the traffic was human.
I've been in security for over a decade, and I can tell you with full honesty that what's happening right now doesn't resemble anything I've worked through before.
The shape of the threat has changed.
When I started, we tracked attackers like weather systems like individual storms with a direction, a motive, and a human operator you could eventually name.
These days I'm watching autonomous agents swarm login pages with the patience and discipline of machines, because that's what they are.
The numbers coming out of October are the ones keeping me up.
Cloudflare just absorbed a 4.2 terabit per second DDoS attack, the largest in recorded history.
Ransomware incidents jumped 41% in a single month.
In September, OpenAI-powered agents got caught attacking RubyGems, a package registry that quietly underpins a huge chunk of software I use every day.
In July, roughly 700 AI agents coordinated an attack on Hugging Face's infrastructure as part of a single automated task.
A Chinese threat actor was publicly caught running full attack chains through DeepSeek with no human at the keyboard.
I keep rereading these reports because each one by itself would've been the biggest story of the year five years ago. Together, in one month, they're the new baseline.
What I want people outside the industry to understand is why this specific moment feels like a hinge.
For thirty years, the thing protecting most of us was simple economics. Attackers had to choose who to target because their time was finite. That ceiling is gone.
An agent I can rent for pennies will try every leaked password you've ever used against every service you've ever signed up for, in parallel, overnight, and never get tired.
The same math that made ChatGPT useful made opportunistic hacking infinite. The old assumption that you were "too boring to be a target" relied on scarcity that no longer exists.
I'm not writing this to spiral anyone out.
Most of this fight genuinely isn't yours to win.
But the small things still matter more than people think.
Tonight I'd switch your most important accounts like email, bank, primary cloud, etc. to passkeys or a hardware key.
I'd kill SMS 2FA wherever an authenticator app is offered.
I'd turn on breach alerts in whatever password manager you use.
If you're in the US, I'd freeze my credit at all three bureaus, which is free and takes about ten minutes.
None of that stops the swarm.
It makes you a slightly worse target than the person next to you. In a month like this one, that's the whole game I'm playing too.
@mattshumer_ has summed it beautifully.
Drop everything and go give it a read. Nothing is more important than this article right now.
Peter Guagenti retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Peter Guagenti retweeted
A highlight from NVIDIA GTC Berlin: Jensen Huang spotlighting our work with @baseten on post-training specialized models for code review.
Proud to work with NVIDIA and Baseten to push the frontier of AI for software development!
Peter Guagenti retweeted
PHP users: patch today.
Two critical RCEs (CVSS 9.2) affect "all PHP installations serving web requests".
Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. #php #security thephp.foundation/blog/2026/…
Peter Guagenti retweeted
AI coding tools keep getting better. What are we getting better at?
We sat with @kunalstwt to talk about the skills software engineers should invest in: understanding systems, solving useful problems, and taking responsibility for what ships.
Catch the full 1hr 16 video below!
Peter Guagenti retweeted
New home for your code, same rabbit on review.
CodeRabbit is a launch partner for Cursor Origin's app marketplace, bringing AI code review directly to Origin-hosted pull requests.
coderabbit.ai/blog/coderabbi…
Peter Guagenti retweeted
i'm open-sourcing the code behind the coderabbit music video.
although the template was laid out by @donaldjewkes and @other__reality's videos, there are a few things that were done differently in this video to obtain these results:
1. word-level lyric timing. we split the vocals out with Demucs and force-aligned the lyrics with stable-ts. P(doom)'s karaoke estimates word timing from line length. the alignment also found a sung "as mentioned above" at 2:00 that wasn't in the lyric sheet. a custom f-aligner was buitl
2. we swapped the watercolor (p5.brush) for a spider-verse print look: halftone shading, color-plate misregistration for depth, ink that boils 12x a second, characters on twos. all 3,088 frames render in ~5 min on a laptop. P(doom)'s guide budgets 2.5 s per frame. this is a style reference change more or less
3. no karaoke bar. each line picks a mode which is a huge stacked type for the hook, comic caption boxes for the rabbit's inner voice, ransom-note cutouts at 3am, or typed into the scene ("@coderabbitai pause" in a comment box). x autoplays muted, so it has to read with the sound off and to also get a catchy hook
4. did a LOT of research. one agent audited the AI-twitter zeitgeist (the Navier-Stokes blowup vortex became the rabbit hole). another studied spider-verse technique and K-pop direction, which is why hop/nope/yep get the exact same framing every chorus. a total of 8 video subagents and 3 research agents ran in cursor to achieve this
5. like P(doom), parallel agents built the chapters (8 here), working from a written style sheet and a storyboard locked to the measured beats. the difference was the review loop in which the main agent pulled contact sheets from the encoded mp4 and sent weak shots back with notes
6. just under 4 hours from the raw mp3 to the final encode, in one Cursor session with Claude Opus 5.5. STYLE_SHEET, STORYBOARD and ANIMATION_GUIDE are in the repo if you want to point it at your own song. my total opus costs from my cursor dashboard stand around $200
here's the github repo: github.com/arimanyus/hophopn…
Peter Guagenti retweeted
Know what your PR does.
CodeRabbit Change Stack - your explainability layer:
> Overview + Layers: map the PR's logical changes
> Findings: issues, proposed fixes and agent prompts
> Code Peek + AI Chat: definitions, context, answers
> Blast radius: understand the impact
Peter Guagenti retweeted
CodeRabbit is available in Claude Marketplace!
Apply a portion of your committed Anthropic spend to CodeRabbit, the same route we used for Vercel Sandbox and Workflows!
Read Anthropic's announcement:
claude.com/blog/how-coderabb…
Peter Guagenti retweeted
Beyond the benchmarks, what was Opus 5.5 like to work with?
Hendrik and Gowtham discuss an overnight coding run, the token tradeoffs, and why higher reasoning effort didn’t consistently catch more bugs.
We ran Opus 5.5 through CodeRabbit's review pipeline.
> On 80 known bug patterns it caught 51 vs 49 for our production mix.
> On 13 harder cases, 10 vs 5.
> It found a retry-count race in Cal.com that production missed.
The catch is ~50% more tokens, and 9 bugs our baseline caught that Opus 5.5 didn't.
Read our full Opus 5.5 model evaluation here: coderabbit.ai/blog/opus-5-5-…
AI has solved how software gets written, but it also broke how software is *shipped*. With 1,000's of PRs issued by agents, how do you trust the code that has been generated?
@coderabbitai solved this with a single platform that reviews, explains, triages, and secures every PR:























