GitLab has a major vulnerability with a maximum score of 10, and OVHcloud's software release files on GitHub have been leaked. Even the private key of the certificate that endorses the website's identity is so weak that it is only the number "4". Last week, I just made a video to remind everyone that when AI starts to break through long-standing mathematical problems, we should seriously consider how it will change cryptography, cybersecurity, and the security of financial systems. The recent events have made this issue even more urgent. Let's first take a look at GitLab and GitHub related events. GitLab patched a major vulnerability with a CVSS score of 10.0 on October 21st. Under specific conditions, attackers may execute arbitrary code on the affected GitLab server without logging in. Http://(GitLab. com) has been patched, but self installed enterprises need to update. This is a confirmed major vulnerability and cannot be directly described as a 'GitLab full platform hack'. ( http://docs. (gitlab.com)) On GitHub, OVHcloud has confirmed that a developer's GitHub account has been hacked. The attacker replaced some CLI software release files with malicious versions on October 19th, attempting to steal confidential information from the user's computer. The trust chain between developer accounts and release files was breached this time, and it has not been confirmed that the GitHub platform itself was hacked. (http://((((github.com))))) Imagine this: you are just going to a familiar project download tool, but the downloaded content has already been replaced. OVHcloud Event Announcement: https://((((github.com))))/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw In the same message, Railway also announced that customer environment variables may have been accessed without authorization, and some content may have been decrypted, involving confidential information such as API keys and database account passwords; Oracle Java has issued a security alert with a score of 9.1. ( http://blog. (railway.com), http://(oracle.com)) These events involve the infrastructure that businesses rely on every day. But what left me dumbfounded the most was eMudhra. It is a digital certificate authority. Simply put, these types of organizations are responsible for endorsing the website's identity, allowing your browser or application to determine: "The website I am currently connected to is really the one I am looking for This time, the private keys of 8 relay certificates are weak enough to be quickly restored. The cybersecurity researcher actually verified that one of the private keys was actually "4". Not four hundred digits, not starting with 4. It's 4. ( http://scotthelme.co.uk ) What does this have to do with financial security? When you log in to online banking, connect to payment services, or exchange sensitive information with enterprise systems, in addition to protecting the transmitted content, there is a basic prerequisite: You must be able to confirm that the person on the other side is really the one you thought they were. If the private key endorsing the website's identity falls into the hands of someone else, in a system where the relevant trust has not been revoked, attackers may forge credentials and, in conjunction with traffic interception and other conditions, impersonate legitimate services. Cloudflare has deployed protection against this incident and has made it clear that the problem lies with credential authentication, not the TLS encryption algorithm itself. ( http://blog. ((cloudflare.com))) This does not mean that the bank account has been completely breached, but it exposes a very real problem: Even the most complex financial system can be dragged down by an extremely low-level error. Event description: https://blog. ((cloudflare.com))/emudhra-certificate-compromise/ There is already a direct connection between AI and major vulnerabilities. The two major vulnerabilities announced in PHP this time, both with a severity of 9.2, may result in unverified remote code execution. Google officially stated that Wiz uses multiple models to assist in research, among which Gemini 4 Argon is involved in vulnerability discovery, exploitation development, attack detection, and patch verification. This is defense research, but it clearly shows that AI can already participate in discovering and analyzing major software vulnerabilities. ( http://cloud. (google.com)) When this ability becomes stronger, cheaper, and easier to acquire, everything that both the offensive and defensive sides can do will change. Looking back at the mathematical progress in September and October. OpenAI announced in September its internal system's solution and formal proof of the Navier Stokes millennium problem; In October, a large number of mathematical research results generated by AI were made public. The different achievements are still in different stages of validation, but these publicly available studies are sufficient for us to reassess the depth to which AI can handle problems. (http://((openai.com)), http://((openai.com)), http://((((github.com))))) Research data: https://((((github.com))))/openai/math So what I really want to ask is: When AI can delve into these mathematical problems, have we equally evaluated its capabilities in cryptanalysis, key management, certificate verification, and software vulnerabilities? What is the difference between the publicly available results and the capabilities being tested internally? I believe that discoveries involving significant security risks may not be immediately and fully disclosed like typical research results. But since it has not been made public, it cannot be directly inferred that it must have been cracked. Something worth being vigilant about no longer requires this inference to hold true. As for the recent claim linking Fable 5.5 to swarm attacks, there is currently not enough first-hand evidence to confirm it. However, the division of labor, continuous testing, and exchange of results among multiple AI agents is indeed a serious attack scenario that deserves serious consideration. If attackers can make these agents operate 24/7, while companies still have to hold meetings, schedule, and outsource to repair vulnerabilities, what would be the difference in attack and defense speed? For financial institutions, risk is not limited to the programs they write themselves. Certificate authorities, cloud platforms, development tools, software suites, outsourcing systems, as long as one of them encounters a problem, can become the entry point that needs to be addressed. Especially when updating old systems is difficult, supplier permissions are unclear, and confidential keys are scattered everywhere, the increased attack efficiency brought by AI may enable previously overlooked issues to be exploited faster. ⚠️ What I reminded last week was this kind of risk. The events of these days do not yet prove that 'AI is breaking through the global financial system', nor is there evidence to suggest that they are all caused by the same wave of AI attacks.