If you were wondering why a third of the internet is burning right now, this is why.

{
  "hook": {
    "spoken": "If you were wondering why a third of the internet is burning right now, this is why.",
    "ends_at": "00:05.5",
    "on_screen": "Black October: AI Set a Third of the Internet on Fire — AI Attack Alert",
    "starts_at": "00:00.0",
    "technique": "bold_claim",
    "technique_note": "Combines hyperbole with an imminent massive security threat framing.",
    "why_it_stops_the_scroll": "Viewers immediately want to know if their own digital systems or services are compromised."
  },
  "tags": {
    "topics": [
      "ai",
      "cybersecurity",
      "hacking",
      "tech news",
      "infosec"
    ],
    "cta_type": "none",
    "language": "en",
    "has_music": false,
    "has_speech": true,
    "content_type": "talking_head_advice",
    "products_or_apps": [
      "PHP",
      "GitLab",
      "Plex",
      "WordPress",
      "Node.js"
    ],
    "has_burned_captions": false
  },
  "audio": {
    "music": "None",
    "voice": "Male voice, close-mic, intense and urgent delivery",
    "ambient": "Quiet interior room tone",
    "mix_notes": "Dry, clean voice track with no background music or processing",
    "sound_effects": "None"
  },
  "shots": [
    {
      "end": "03:24.8",
      "index": 1,
      "start": "00:00.0",
      "camera": "Front-facing smartphone camera at eye level",
      "framing": "Chest-up frontal framing",
      "movement": "Handheld static with slight organic drift",
      "shot_type": "medium close-up",
      "transition_in": "none",
      "screen_content": "None",
      "subject_action": "Addresses camera urgently, gestures with hand and fingers, recites list of hacks",
      "what_is_visible": "Speaker talking directly to camera, gesturing with hand, glancing at screen notes",
      "duration_seconds": 204.8,
      "spoken_during_shot": "If you were wondering why a third of the internet is burning right now, this is why. I'm about to read you the list of 19 incidents that have occurred between October 19th and 22nd. This is an ongoing list. You might be wondering, why does it feel so unsafe out there internet wise? It is because the AI attack apocalypse is here. And, you know, that sounds a little dramatic, like we still have internet right now, etc., I'm posting this, but what is actually going on is that all of the risk from Mythos that we talked about where we said, you know what, this is a big cyber risk over time, wait about six months, open source models are going to get this, thieves are going to get this, bad actors are going to get this, and they're going to use it to attack things. Well, hey hey, it's been six months, guess what we're doing now? We are attacking the internet. So, there are at least 19 that I have tracked, and I'm going to run them super quick for you, but this is a serious thing. You need to be paying attention. You need to ask your AI, how can I scan my computer and make sure I'm up to date? How can I make sure I'm rotating my passwords? If you are building anything, make sure you are taking the security of your environment extremely seriously right now. It's not a joking matter. Because just in the last three days, 19. Number one: PHP, which is what took out a third of the internet, because basically there are critical flaws, there are end-of-life PHP instances out there that have sensitive information. There are government websites down over this, this one's not good. eMudhra: eight compromised certificate signing keys that had almost zero entropy, which is basically a way of saying they're super easy to crack, but they're like trusted by the whole internet. Railway: possible exposure of customer configuration settings. Railways, yeah, definitely in trouble there. Zeboor: a lot of people don't know about that, but they exposed 321,000 accounts worth of data. LightLLM: October 21, a compromised release process distributed credential stealing malware. GitLab: emergency patches for a severity 10 vulnerability. I'm having to read these 'cause there's so many. Karen: researchers exposed ongoing AI-driven criminal hacking and verified some intrusions. Onamae.com: malicious programs found on customer servers in Japan. OVHcloud CLI: attackers replaced official downloadable tools with credential stealers. Team Updraft and WordPress: attackers used stolen connection keys to access customer websites. Plex: active exploitation reported on October 19th. Attackers exploited home media servers. Meta Muse: discoverable shared conversation links exposed personal files and business docs without requiring a login. HTTP/3 QPACK: researchers disclosed resource exhaustion weaknesses in seven out of 10 implementations that they tested, which is also bad. Siemens Software Center had one, that's number 14. Bullhorn had one. Ahold Delhaize is a supermarket group that got hacked. State Bank of India got hacked. ConnectWise RMM also had AI-assisted attacks. Node.js, which is huge, is number 19. This is a lot, guys. Please pay attention to cyber. I've been making a few videos about this for a reason.",
      "on_screen_text_during_shot": [
        "Black October: AI Set a Third of the Internet on Fire — AI Attack Alert"
      ],
      "facial_expression_or_gesture": "Wide-eyed concern, pointing finger, rubbing beard"
    }
  ],
  "video": {
    "pacing": "Fast, urgent, conversational",
    "setting": "Home office with light green wall and framed art",
    "subject": "Bearded adult male wearing glasses and black collared sports jersey",
    "lighting": "Soft frontal key light with natural room ambient",
    "color_grade": "Natural, slightly warm indoor tones",
    "orientation": "vertical",
    "aspect_ratio": "9:16",
    "overall_format": "talking-head monologue",
    "tone_and_energy": "Serious, frantic, urgent",
    "duration_seconds": 204.8,
    "wardrobe_and_look": "Casual black rugby shirt with white collar and silver logo; short brown hair, beard, glasses"
  },
  "script": [
    {
      "end": "00:05.5",
      "line": "If you were wondering why a third of the internet is burning right now, this is why.",
      "start": "00:00.0",
      "delivery": "Urgent and intense direct address",
      "uncertain": false
    },
    {
      "end": "00:11.8",
      "line": "I'm about to read you the list of 19 incidents that have occurred between October 19th and 22nd.",
      "start": "00:05.5",
      "delivery": "Serious, direct to camera",
      "uncertain": false
    },
    {
      "end": "00:22.0",
      "line": "This is an ongoing list. You might be wondering, why does it feel so unsafe out there internet wise? It is because the AI attack apocalypse is here.",
      "start": "00:11.8",
      "delivery": "Emphatic, wide-eyed",
      "uncertain": false
    },
    {
      "end": "00:50.0",
      "line": "And, you know, that sounds a little dramatic, like we still have internet right now, etc., I'm posting this, but what is actually going on is that all of the risk from Mythos that we talked about where we said, you know what, this is a big cyber risk over time, wait about six months, open source models are going to get this, thieves are going to get this, bad actors are going to get this, and they're going to use it to attack things. Well, hey hey, it's been six months, guess what we're doing now? We are attacking the internet.",
      "start": "00:22.0",
      "delivery": "Passionate, cautionary, fast-paced",
      "uncertain": false
    },
    {
      "end": "01:16.0",
      "line": "So, there are at least 19 that I have tracked, and I'm going to run them super quick for you, but this is a serious thing. You need to be paying attention. You need to ask your AI, how can I scan my computer and make sure I'm up to date? How can I make sure I'm rotating my passwords? If you are building anything, make sure you are taking the security of your environment extremely seriously right now. It's not a joking matter. Because just in the last three days, 19.",
      "start": "00:50.0",
      "delivery": "Stern advisory warning",
      "uncertain": false
    },
    {
      "end": "03:18.0",
      "line": "Number one: PHP, which is what took out a third of the internet... [reads exploits 2 through 19: eMudhra, Railway, Zeboor, LightLLM, GitLab, Karen, Onamae, OVHcloud, Updraft/WordPress, Plex, Meta Muse, HTTP/3 QPACK, Siemens, Bullhorn, Ahold Delhaize, State Bank of India, ConnectWise, Node.js].",
      "start": "01:16.0",
      "delivery": "Rapid listicle recitation reading off screen",
      "uncertain": false
    },
    {
      "end": "03:24.8",
      "line": "This is a lot, guys. Please pay attention to cyber. I've been making a few videos about this for a reason.",
      "start": "03:18.0",
      "delivery": "Earnest closing warning",
      "uncertain": false
    }
  ],
  "editing": {
    "cut_count": 1,
    "transitions": "None",
    "caption_style": "Native TikTok dynamic closed captions",
    "end_card_or_cta": "Verbal advisory to pay attention to cybersecurity",
    "average_shot_seconds": 204.8,
    "effects_and_overlays": "Purple title card banner overlay during the first 12 seconds"
  },
  "teardown": {
    "hook": "If you were wondering why a third of the internet is burning right now, this is why.",
    "format": "talking-head",
    "mechanism": "curiosity_gap",
    "structure": [
      "Alarms viewer with high-stakes claim about massive internet breakdown",
      "Frames crisis as predicted wave of AI-assisted cyber exploits",
      "Rapidly lists 19 specific major security breaches occurring within 72 hours",
      "Urges immediate viewer action on passwords and system vulnerability scans"
    ],
    "hook_source": "transcript",
    "why_it_worked": "Urgent technical breakdown backed by an exhaustive real-world list of 19 concurrent exploits created intense FOMO and security panic."
  },
  "on_screen_text": [
    {
      "end": "00:12.0",
      "kind": "hook",
      "text": "Black October: AI Set a Third of the Internet on Fire — AI Attack Alert",
      "start": "00:00.0",
      "style": "bold white text on dark purple rounded rectangle badge",
      "source": "creator overlay",
      "position": "top center"
    }
  ],
  "structure_beats": [
    {
      "end": "00:11.8",
      "beat": "Alarming hook",
      "start": "00:00.0",
      "purpose": "Grab attention with extreme scale of current internet breach"
    },
    {
      "end": "00:50.0",
      "beat": "Context & Thesis",
      "start": "00:11.8",
      "purpose": "Frame ongoing crisis around AI-accelerated malware timeline"
    },
    {
      "end": "01:16.0",
      "beat": "Call to Preparedness",
      "start": "00:50.0",
      "purpose": "Advise builders and users to scan systems and update credentials"
    },
    {
      "end": "03:18.0",
      "beat": "Rapid Evidence List",
      "start": "01:16.0",
      "purpose": "Provide undeniable credibility by citing 19 real incidents"
    },
    {
      "end": "03:24.8",
      "beat": "Closing Warning",
      "start": "03:18.0",
      "purpose": "Reiterate seriousness and prompt continued vigilance"
    }
  ],
  "recreation_blueprint": {
    "shot_template": [
      {
        "slot": "Opening Hook & Context",
        "visual": "Close-up talking head speaking directly into camera with urgent expression",
        "seconds": 50,
        "voiceover": "Claim an industry-wide disaster is occurring and frame its systemic cause",
        "text_overlay": "Bold headline overlay defining the crisis"
      },
      {
        "slot": "Action Advice",
        "visual": "Talking head leans closer and delivers concrete preventative steps",
        "seconds": 26,
        "voiceover": "Tell viewers exact steps to audit and secure their setup",
        "text_overlay": "None"
      },
      {
        "slot": "Rapid-Fire Evidence Roster",
        "visual": "Talking head reads through 15-20 distinct high-profile incident examples",
        "seconds": 122,
        "voiceover": "Rapid-fire rundown of dates, targets, and specific breaches",
        "text_overlay": "None"
      },
      {
        "slot": "Outro Warning",
        "visual": "Direct look into lens with sobering closing remark",
        "seconds": 6.8,
        "voiceover": "Final caution reinforcing the stakes",
        "text_overlay": "None"
      }
    ],
    "what_can_change": [
      "Subject matter niche (fintech, crypto, AI regulation)",
      "Specific list count (e.g. 10 instead of 19)",
      "Background and creator outfit"
    ],
    "template_summary": "Single continuous take breaking down a niche emergency using an overwhelming list of rapid citations.",
    "what_must_be_kept": [
      "Continuous uncut take",
      "High volume of concrete, named incidents",
      "Urgent raw delivery without background music"
    ],
    "generation_prompts": [
      {
        "prompt": "Medium close-up portrait of an anxious tech professional speaking urgently to camera in home office, natural indoor lighting, raw smartphone video style.",
        "shot_index": 1,
        "negative_prompt": "Cinematic lighting, studio background, motion graphics, background music, multiple camera cuts."
      }
    ]
  },
  "props_apps_and_products": [
    {
      "name": "PHP",
      "how_used": "Referenced as root cause for major web outages",
      "first_seen": "01:16.8"
    },
    {
      "name": "GitLab",
      "how_used": "Referenced regarding emergency security patch",
      "first_seen": "02:02.0"
    },
    {
      "name": "Node.js",
      "how_used": "Referenced as compromised platform",
      "first_seen": "03:15.0"
    }
  ]
}