[AINews] Black October

AINews recaps a roughly 48-hour wave of critical vulnerability disclosures and breaches, including an unauthenticated RCE in PHP, a CVSS 10 GitLab flaw, a compromised LiteLLM release, weak eMudhra CA keys, and exposed patient data at Quest Diagnostics. Microsoft attributes the ConnectWise supply-chain compromise to China-aligned Storm-0940, which used the open agentic pentest framework ARTEX against 2,250+ Microsoft 365 tenants, and Anthropic's deputy CISO warns things will get worse before they get better. The issue also covers METR/Redwood's embedded evaluation of OpenAI's misalignment monitoring, new open models such as MiniMax M3.1 Flash and Carbon-X, and benchmark results from AA's Coding Agent Index v2.0 and CritPt v2.