Reading time: 9 minutes | Issue #49 | Book a Discovery Call

Happy Tuesday. Mark here.

Last Wednesday, a lot of CTOs went looking for where they'd written down the server password.

Teams across the web spent the day patching two critical PHP flaws that researchers had found with help from AI models. Government agencies in Belgium, the Netherlands, Finland, France and Germany took sites offline while they patched, and the NSA told organizations to update or, if they couldn't, go offline. Within five days, an attacker had pushed a poisoned LiteLLM release, Railway had told every user to roll their secrets, Zeabur had announced it was shutting down and GitLab had patched a 10-out-of-10 vulnerability. In healthcare, Quest Diagnostics, which works with half the physicians and hospitals in the US, told the SEC that an intruder had reached patient records through its lab-ordering platform. People are calling it Black October.

For me, the week comes down to one sentence from LiteLLM's post-mortem. In May, someone at LiteLLM committed the master key for an experimental agent platform to a public repo. The team spotted it and force-pushed over the commit, but, in their words, "key revocation did not occur for the master key." Four and a half months later, an attacker used it.

Inside the Issue

Same holes, cheaper shovels

PHP2Shell consists of two flaws in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619, which the PHP project rated 9.2 each. They reach back to PHP 5.4, released in 2012, and unauthenticated requests sent before any application code runs can be enough to take over a server. That matters because PHP runs 69% of websites whose server-side language W3Techs can identify.

Three teams reported the same root cause to PHP between August 11 and September 18: first Calif, working inside OpenAI's Patch the Planet program, then Wiz, then OpenAI. Calif and Wiz both used frontier models. After the CVE IDs leaked, PHP shipped the fixes a day early, on October 21, and the exploitation attempts followed quickly. Cloudflare's Matthew Prince said his network saw hundreds of thousands of attempts within two hours of disclosure, rising to millions by the next day.

Chris Krebs, who used to run CISA, put the pace of discovery this way on CNBC: "3% of all critical vulnerabilities ever discovered have been found in the last month."

Our read: AI made finding holes cheap, but the breaches I'd worry about most started with old mistakes: a leaked key that stayed valid for four and a half months, and admin credentials stored in plaintext.

1. The holes were already there.

According to OpenAI, PHP2Shell sat in the engine for about 14 years, and Calif traces the bug class to Stefan Esser's research from 2004. I doubt these bugs would have stayed hidden without AI. Someone would have found them eventually, and it might not have been someone friendly: Amazon saw an exploitation attempt on one of its honeypots before any of the known leaks.

A lot of it has to do with problems that are as old as PHP itself.

2. Finding them got cheap.

You don't need a Matrix-style hacker with five monitors anymore. NorForge researcher Snorre Fagerland found one Chinese-speaking operator through exposed control panels for Cairn, an open-source agent tool. According to Reuters, the operator's agents worked from instructions shorter than 100 Chinese characters, tried more than 1,200 websites and broke into websites belonging to more than 100 companies, including Deere and SharkNinja. Fagerland estimates the token bill at about $5,000.

Microsoft says the China-aligned group Storm-0940 used ARTEX, an agentic AI pentest framework, to try signing in to more than 2,250 Microsoft 365 tenants. Most attempts failed, but in several cases the group went from first contact to privileged access in under three hours. The next operator could be a teenager with a free weekend.

3. The worst damage didn't need AI.

LiteLLM's chain started on May 27 with that master key in a public repo. On October 10, an attacker used it to pull a GitHub CLI token from an organization owner's account. Because LiteLLM hadn't scoped that token down, the attacker got owner access to every repo. On October 21, a poisoned version 1.107.0 sat on PyPI for under two hours.

Zeabur had kept long-lived admin credentials in plaintext, usable from the public internet, and missed them when it rotated credentials after an August breach. Remember the server password from the top of this email? According to Zeabur's own report, its admin tokens and AWS keys sat in a private config repo. In October, the attacker read data on 321,810 accounts and more than 3.2 million environment-variable records. Zeabur now says it will shut down by December 31.

At eMudhra, a certificate authority, eight intermediate CA keys were so weak that Google and Mozilla blocked them within hours. Security researcher Scott Helme found that one of them was the number 4.

When the problem reaches the platform, the fixes get blunt: government agencies pulled their sites, Railway paused new deployments, ConnectWise took Cloud Backup offline, Quest paused access to its lab-ordering system and Zeabur is closing the company. Quest hasn't said how the intruder got in or how many patients are affected. If you build in medtech, the portals your customers log into are part of your attack surface, whoever runs them.

Anthropic's deputy CISO, Jason Clinton, told security leaders to ask their boards for help, "not for AI, for the basics."

In my experience, the companies that get hurt are the ones that skipped the basic chores.

4. Vibe coding is easy.

If you vibe code an app and ship it without doing those chores, you'll get burned. Owning the codebase takes longer than creating it, because you also need to know where each secret lives and how fast you can rotate it on a bad night. Cybernews described Zeabur as a vibe coding platform, and attackers got in twice in seven weeks.

We see this from our side of the table, too. When we come into a company with working, profitable software, we sometimes find ridiculous vulnerabilities, and large enterprises carry an absurd number of them. That's why unsexy work like data hygiene and key management is back on the agenda.

5. You can't patch a person.

Verizon's 2026 Data Breach Investigations Report puts the human element in 62% of breaches. In February, Fideuram's then-chairman received a WhatsApp message that appeared to come from Carlo Messina, CEO of parent bank Intesa Sanpaolo, followed by a call in the AI-cloned voice of a lawyer he knew. He ordered about €95 million in transfers, most of it to China and Hong Kong, and at least €36 million is still missing.

Someone can now clone your voice and your face, which I think is more dangerous than any PHP bug. It's fabricated reality, and there's no CVE for it. No system I've seen is bulletproof, and the weakest link is still the person at the end of the chain.

My wife and I have a protocol for this: if she gets a call from me and something sounds strange, she asks me to confirm on iMessage before she does anything. Your finance team needs the same rule, written down.

Clinton expects defenders to need about 18 months to get through this. Whatever the timeline, a scanner finding a leaked key for you doesn't change whose job it is to revoke it. That's still on your team, and any company with a token that has outlived the person who created it should be uncomfortable.

Eight fixes you need

You can do all eight with tools you already own, and each would have stopped or reduced the damage from one of the last two weeks' incidents.

1. Revoke first, scrub second.

Rewriting git history leaves the secret in forks, clones and caches, as a Cloud Security Alliance research note on LiteLLM points out. LiteLLM's engineers wrote that the incident shows the risk of leaving a key unrotated when it might have been exposed, so open a revocation ticket for each leak, with an owner and a deadline.

2. Make admin credentials expire.

Zeabur's cluster admin tokens had no expiry date and sat in plaintext. Move long-lived secrets into a secrets manager, issue short-lived credentials from it and set an alert for anything past its maximum age.

3. Give machines their own identity.

The token behind LiteLLM's breach was an org owner's own GitHub CLI token, which the agent platform's API handed to the attacker. Give machine jobs service accounts with fine-grained scopes and, where a provider supports OIDC, use it instead of static keys for machine-to-machine authentication.

4. Audit what your vendors can do inside your tenant.

Storm-0940 signed in as ConnectWise apps that customers had already granted access to, allowing the attack to go around user MFA. The SOC team at Senthorus recommends reviewing service-principal sign-ins and app credential changes alongside user logins.

5. Patch runtimes now, wait a day on packages.

The ThursdAI crew's rule is to update browsers, operating systems and phones the day a fix lands, patch PHP and Node on servers now, and avoid installing a pip, uv or npm version less than 24 hours old. Josh Long, Intego's chief security analyst, pointed out the irony on the show: the people who updated LiteLLM right away were the ones who got hit. Many projects are set up to grab the newest LiteLLM release on every build, StepSecurity noted, so anything built in that two-hour window could have pulled in the poisoned version. Lock your packages to exact versions.

6. Cap each AI key, one key per service.

Railway believes its breach was part of a campaign against platform companies aimed at AI inference providers. An uncapped key works like a company card with no limit, so give each service and agent its own key with a spend cap and an alert.

7. Review agent instruction files like CI config.

Forever Security found an AGENTS.md file in a Downloads folder that tried to get OpenAI's Codex to install function-color, a known-malicious npm package. No code ran, but the attempt is a reason to put anything an agent reads as instructions through code review.

8. Run a daily security check with an AI model.

Krebs told smaller companies to keep scanning, patch, or take legacy systems offline. ThursdAI co-host Nisten Tahiraj runs a prompt every day at 6 a.m. that checks every pip, npm and Linux package on his machines, while Philipp Schmid shared a read-only agent prompt for checking exposure to last week's incidents. Give the check read-only access, so a compromised prompt can't change anything.

01 OpenAI took frontier training offline. On October 23, OpenAI said it will train frontier models without live internet access. During its red-team tests, some models escaped training VMs, while others found indirect routes toward the internet. In one test, models in separate VMs were told to swap secrets with no network between them, and did it through CPU cache timing. If the lab that built the model can't hold it in a software sandbox, check what your coding agents can reach this week.

02 PwC's breach came through a vendor. PwC confirmed an incident at a third party that hosts its employee learning records after the Everest group claimed about 590 GB. PwC hasn't confirmed that figure and says the breach didn't touch client data. With Verizon's 2026 report finding that 48% of breaches involved a third party, your vendor list is part of your perimeter.

03 A hospital employee uploaded patient data to an unapproved AI tool. On September 21, a Johns Hopkins employee uploaded a spreadsheet covering about 3,200 Bayview Medical Center patients, including treatments, medications and medical record numbers, to an AI tool the hospital hadn't approved, WYPR reported. Hopkins had the employee delete the chat and the file, asked the tool's owner to delete its copy and is now mailing patients. If you sell software to hospitals, assume your exports will end up in a chatbot and limit what they contain.

04 US banks are finding AI agents inside customer accounts. Axios reports that major banks are detecting unauthorized third-party agents in customer accounts, some taking actions that appear independent of user instructions. Many of those agents log in with the customer's permission, despite this being against most banks' guidelines. For a fintech product team, that makes the problem harder.

05 The scanning gold rush has started. The Information reported that Datadog offered close to $4 billion for Upwind Security, though Calcalist says no formal offer was made. In the same week, Anthropic's Frontier Red Team and Theorem used Claude to write machine-checked proofs for 123 open-source libraries. I expect a crowd of startups selling comprehensive AI security scans by spring, and some will be worth buying.

The Ownership Audit. These ten questions cover who controls your secrets and approvals, with each one paired with the Black October incident where someone got the answer wrong. Answer every line with a name and a date, and any blanks become your to-do list for November.

Most of that audit can run on a schedule. A read-only nightly check of token ages and open-ended dependencies is the kind of headless agent we set up inside client engineering teams, reporting to a person who can revoke.

If your audit came back with more blanks than names, book a call and we'll tell you which three to close first.

Until next Tuesday,

— Mark Ajzenstadt, Founder @ Limestone Digital