Only when it matters: what is happening, and what to do.https://hard.fyi/en-auhttps://hard.fyi/journal/rules-off-20-a-month/https://hard.fyi/journal/rules-off-20-a-month/Abliteration.ai sells access to frontier AI models with their refusals removed, with a free sign-up, no identity checks and no record kept of what's asked. What to do: Nothing to change today. Make sure nobody moves money or shares a code because of a message alone: they call back on a number they already had.Wed, 21 Oct 2026 22:00:00 GMThttps://hard.fyi/journal/ai-keys/https://hard.fyi/journal/ai-keys/Railway, a hosting platform popular with developers, says someone accessed the secrets customers store with it, some decrypted. It believes it's part of a series of attacks on platforms, aimed at AI providers, after Fireworks AI and OpenCode. What to do: If your company, family office or anyone building software for you uses Railway, OpenCode or Fireworks AI, ask them to change every stored key and password today, and to set spending limits on AI accounts.Wed, 21 Oct 2026 22:00:00 GMThttps://hard.fyi/journal/php2shell/https://hard.fyi/journal/php2shell/PHP, the language behind about 7 in 10 websites, released fixes on 21 October. Some security firms report early attacks; others, and the US agency CISA, haven't seen any. PHP 8.1 and older get no official fix. What to do: Ask anyone who runs a website for you whether it now runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or their vendor's fixed version. If it's on PHP 8.1 or older, ask for a plan to upgrade or take it offline. Ignore emails urging you to log in for a security update.Wed, 21 Oct 2026 22:00:00 GMThttps://hard.fyi/journal/guardrails-off-in-35-hours/https://hard.fyi/journal/guardrails-off-in-35-hours/35 hours after DeepSeek released V4.1 Flash, a patch removing its refusals, including around cyber attacks, appeared on Hugging Face. What to do: Nothing to do today. Expect scam emails, texts and calls to keep getting more convincing.Sun, 18 Oct 2026 22:00:00 GMT