Read Time: 8 minutes

Brought to you by:

Howdy friends!

Writing from the Las Vegas airport on a long delay headed home from SentinelOne’s OneCon where we recorded a live podcast on their show floor. It was a blast and we got some really really solid footage and interviews in the pipe for the next podcast drop in a few days so make sure you’re subscribed to catch that.

🖊 Something I wrote: Back in 2013 I built a botnet on an ad network for some research.

🎧 Something I heard: Low Level’s PHP vid

🎤 Something I said: Hacking fridges and crypto wallets

🔖 Something I read: This thread from Halvar Flake about the future of coordinated disclosure

You know it's a week when the Prime Minister of Japan is posting patch guidance at 10 PM. PHP shipped fixes for CVE-2026-109618 and CVE-2026-109619, two pre-auth RCEs found by Calif and later validated by Wiz and OpenAI, in code dating back to PHP 5.4 (2004!!!). Default config RCE is validated on Apache mod_php. On PHP-FPM it depends on what your app does with input, and Calif still showed pre-auth RCE on WordPress, Drupal, MediaWiki, Magento, Laravel and a pile more. The embargo fell apart early: the CVE IDs leaked on Hacker News, Calif accidentally posted a PoC video, and Amazon caught an exploit attempt four days before disclosure.

Chainguard was identified as the source of the leak. Well, at least one source, I think the cat was on the way out of the bag already. CEO Dan Lorenc owns the call to push patched images to customers more than six hours before the embargo lifted, which the PHP Foundation says let anyone diff the fix while everyone else waited. His reasoning, from a LinkedIn post: his team had already rediscovered the bugs on its own with an AI harness and a frontier model alongside an embarrassingly simple prompt. He apologized to the maintainers for the extra stress and called it "unfortunately the new normal for the industry."

My take is he messed up. Can’t just unilaterally break the trust of a large embargo group like that. HOWEVER, it is not a good idea for us to pretend that we are in the same old world where coordinated disclosures behind closed doors can happen for days/weeks. If they need to happen they need to happen in hours.

Coordinated disclosure assumes a secret can stay secret for a few weeks while the fix gets built. When rediscovery is cheap, everyone on the pre-notification list is sitting on the same decision Lorenc made. OpenAI is already pitching more systematic coordination between maintainers, vendors and governments. Expect embargoes to get shorter and messier.

Then the governments showed up. NSA, the FBI and CISA all said if you can't update immediately, take the system offline, and the UK NCSC and CERT-EU softened that to "consider" it. A lot of people listened. The Dutch NCSC pulled its own website, and so did the Dutch parliament, the Port of Rotterdam, Finnish and French government sites, and the University of Vienna's webmail. watchTowr and Cloudflare are seeing plenty of exploit attempts, nobody has confirmed a successful compromise yet, and neither CVE is in KEV. The bug lives in PHP itself, so the fix is a PHP update whatever app sits on top: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. 8.1 and older get no official release. If you can't patch today, Cloudflare has WAF rules on every plan including free.

The other thing I want to make sure to cover, now that everyone has a super powered vuln finding laser beam pointed SQUARELY at PHP to try to find this vuln or make a PoC exploit - I think there is no way we don’t find new issues during this effort with this much scrutiny. (read more here, here, here and here)

AI is helping developers build software faster than ever. But if threat modeling still depends on manual processes and disconnected workflows, how can security possibly keep up?

NexusAI brings AI-powered automation to enterprise threat modeling, helping teams create and analyze threat models, prioritize relevant risks, and integrate security into existing development workflows. Built on ThreatModeler's Secure Design Graph, it turns organizational security knowledge into a foundation for more consistent, scalable security decisions.

Explore ThreatModeler Nexus

*Sponsored

Well we're so back. LiteLLM got hijacked by TeamPCP in March and now it's happened again. Version 1.107.0 went out on PyPI and Docker Hub, including the latest tag, carrying a credential stealer and an hourly remote code loader. It was live on PyPI for under two hours and Wiz counts roughly 49,000 downloads. Installing it was enough, since it drops a startup hook that runs every time Python starts, pip included. It grabs cloud creds, SSH keys, Kubernetes and Vault secrets, AI coding tool tokens, and the LiteLLM proxy database with every provider key you stored in it. Wiz saw stolen AWS role creds getting tested about four and a half hours later.

The attacker stole GitHub CLI tokens for three developer accounts and used one to override branch protection and point the release pipeline at a lookalike repo, a second to approve the production release, and a third to delete the run records. That walked straight through the CI/CD hardening LiteLLM built after March, because its own pipeline signed the bad build. JFrog sees no link to TeamPCP this time (probably because they’re in jail…). If you touched 1.107.0, rebuild from scratch pinned to 1.106.2, don't start cleanup by running pip, and rotate everything that host could reach. (read more here, here and here)

Railway is back in the newsletter, and last time it was a CDN serving other people's logged-in data. This time it paused builds and deploys across the entire platform after an attacker "may have accessed" encrypted environment variables and, for some of them, got the decrypted values. Railway thinks it may be a subset of users, and it's still telling everyone to roll every env var and registry credential they keep there, immediately. It also killed all OAuth sessions and API tokens, rotated bucket credentials and warned AI inference providers so they could revoke keys.

Railway says this is part of a series of attacks on platform companies aimed at AI inference keys, and Zeabur fits the pattern. It got breached in August, then again on Oct 14 by someone mostly hunting AI keys, with about 3.2 million env var records exposed. Three days later the founder announced the platform is shutting down on Dec 31. Nobody has tied these to one actor yet. If you're on Railway, rotate now and watch your AI provider and cloud bills, and Railway has per-provider guides for checking. (read more here, here and here)

Cursor, Copilot and Claude Code write more code in a day than your AppSec team can review in a month. Legit Security stops vulnerabilities at the point of generation, fixes the backlog with AI agents, and uses business context to show you which risks actually matter. See how it works on your stack.

Check out a Demo

*Sponsored

As if the coding language behind 70% of the web wasn’t enough, how about undermining the entire SSL Certificate system of trust? eMudhra is an Indian certificate authority, and the private keys for eight of its intermediate CAs were supposed to be random numbers about 116 digits long. Every one of them was under 256. One of them was 4. Not 4 digits, the number 4. A researcher found it by running Google's paranoid_crypto over every CA certificate in the shared root program database, then proved it by signing a test message with each key. eMudhra's explanation in the Mozilla bug is that a flawed key ceremony script generated a second, weak key pair and staff used it by mistake. Commenters are asking how its certified HSMs produced keys like that at all.

The response was fast, to the point of it being not impactful since disclosure. Chrome and Firefox blocked all eight within hours on Oct 17, eMudhra revoked them the next day, Mozilla and Chrome are dropping the whole root, and on Oct 22 eMudhra announced it's leaving the global TLS business. Chrome says no TLS certs chaining to these CAs ever showed up in CT logs, so browsers that enforce CT were covered. The real exposure is curl, scripts and apps with their own bundled trust stores, so update your runtimes and CA bundles. About 30,000 legit customer certs under that root now need replacing. (read more here, here and here)

One more for the AI key theft pile. Last Friday OpenCode said someone got into a legacy system it was decommissioning and may have grabbed the OpenAI, Anthropic and Google keys stored in OpenCode Console, its hosted service where teams share model access without seeing the key. It hit 1.4% of Console users, all of them people who had linked an outside provider. Co-founder Dax Raad says the CLI and desktop app keep keys on your own machine, so those are out of scope. Users still woke up to spending alerts, with some reporting charges in the hundreds of dollars and a few over $1,000. Anthropic and Google blocked the exposed keys, and OpenAI and OpenCode say refunds are underway.

OpenCode still hasn't said how the attacker got in or how the keys were stored, and the distillation angle is their claim so far. The fun detail is straight out of the Hugging Face postmortem: Raad says the models they used to investigate did a lot of the work and then started refusing mid incident, until OpenAI gave them access to Daybreak Blue. Meanwhile attackers were hammering their systems nonstop for 48 hours. If you got the email, revoke and replace the key at the provider, since deleting it from Console leaves it live, and review usage back to Oct 16. Everyone else, put spend limits on your AI keys and give each tool its own. (read more here and here)

Another platform this week. PingCAP says someone used stolen service account credentials to wander around TiDB Cloud's internal resources from Sept 9 until it noticed on Oct 7. They got user names and emails, customer contracts and billing config, SQL editor text, source code, and an exported table of encrypted API key values. PingCAP says it found no evidence anyone touched customer data stored in TiDB.

The extortion crew FulcrumSec has listed it on its leak site and claims 10.6 TB and plaintext API keys, per Dark Reading. Neither claim is verified, and PingCAP says the keys it lost were encrypted. Org owners should rotate every TiDB Cloud management API key now and expect targeted phishing built on that contract and contact data. (read more here and here)

A researcher named kaba got a changed host key warning while SSHing over Tor on Oct 2. He tested every exit relay and found 333 of them quietly routing SSH traffic to the same 12 interception servers. Attackers had hacked the Linux boxes running those relays, at least some with the long-running Ebury OpenSSH backdoor, and reconfigured them as exits. If you logged in with a password, the interceptor kept it, passed your session through to the real server, logged your commands, then used your password to try installing Ebury on your server too. At peak these relays carried about 7.5% of Tor's exit capacity, and most showed the real host key, so plenty of people saw no warning.

The Tor Project flagged them as bad exits on Oct 4 and they were gone from the network by Oct 5. Key-based logins were safe, since the signature only works for that one session. If you SSH'd over Tor with a password between Oct 1 and 5, treat that password as burned, check the server for Ebury, and switch to keys. (read more here and here)

If you patched GitLab on Oct 12, congrats, do it again. CVE-2026-110264 is a CVSS 10.0 unauthenticated code execution bug "under certain conditions," caused by an integer overflow in Ruby's built-in regex engine. It reaches every GitLab back to 7.0 in 2014, CE and EE. It's the third critical regex bug from researcher joaxcar in a month. No PoC and no KEV listing yet, and GitLab.com is already patched. Self-hosted folks, get on the latest patch for your branch, and anything older than 18.11 has to jump to 18.11.13 or later. (read more)

Node.js fixed 10 CVEs this week. The headliner is a High-rated out-of-bounds write in the bundled Google Brotli decompressor that can turn into RCE if your app decompresses attacker-supplied data, like compressed request bodies or fetch responses from a hostile server. OpenAI Codex Security gets the credit. There are also three TLS hostname check bypasses where oddly formatted IP addresses let a cert for one host get accepted for another. No exploitation reported. Update to 26.12.1, 24.22.1 or 22.23.4 and rebuild your containers, since EOL lines get nothing. It's an upstream Brotli bug, so check anything else you run that bundles it. (read more)

Zach Main chained four Plex Media Server bugs into unauthenticated RCE and published a PoC on Oct 16. A honeypot caught exploitation the next day dropping cryptominers and proxy malware, and CISA added all four to KEV on Oct 20. The fix has been out since August in 1.43.3, so this one is on you if you're still behind. Patching won't evict anyone already in, so Plex says to look for unfamiliar processes, unknown codec files and high CPU at idle, and to turn off Remote Access if you don't use it. (read more)

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay