PHP2Shell's credit fight, Railway's leaked secrets, LiteLLM backdoored again, and Claude Duet

Security

PHP2Shell ships, and everyone wants the credit

PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at 14:00 UTC with fixes for CVE-2026-109618 (memory corruption on out-of-memory) and CVE-2026-109619 (stale global state reused by a later request). Both are rated CVSS 9.2. Shortly before the release, the NSA advised that "If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated."

OpenAI claimed the find for its Patch the Planet program (13.9K likes, 5.1M views): "we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact." X added a community note: "the initial discovery and exploit development, however, occurred several months earlier by an independent researcher." Peter Steinberger's quote-tweet got 11.2K likes: "That PHP vulnerability that's gonna cause havoc this week was found with… GPT‑5.6 Sol." Someone asked how many bogus findings came first, and Peter answered "Ofc you wanna use Daybreak these days, much better signal/noise ratio." Another reply noted "google is saying gemini 4 argon helped find it too. everyone wants credit for this one lol."

The write-ups don't agree with each other:

  • Wiz (PHP2Shell, HN, 440 points) says it "used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch." Simon Willison pasted Wiz's timeline into the thread (discovered August 19, reported to PHP August 24, acknowledged September 21) and asked: "I want to understand how it leaked."
  • Calif (php2shell) starts the story with Stefan Esser's 2004 memory-limit RCE and a 2020 bug report. In a passage quoted on HN, Calif says "No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery," and "No model is simply capable of unearthing "all bugs" with simple prompts. At least for now."
  • The PHP Foundation's own account (HN, 714 points) is the most useful. A 2024 Quarkslab audit found "the first signs of the OOM problem." The fix then stalled for months over trade-offs, and the Foundation writes: "We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources." Calif started auditing PHP on July 30 under Patch the Planet, and "On August 11th researcher Ryan A at Calif reported an unconditional remote code execution". OpenAI independently reported the same root cause that same day, and Wiz added vectors on August 24. The Foundation also says it scanned PHP with Claude Mythos earlier in the year and now uses OpenAI's Daybreak Red to validate reports. The team has published 15 CVEs since July 1 and worked through more than 100 invalid, duplicate or unreproducible reports.

The leak came from several places. On October 20 the CVE IDs circulated "with a wrong release time and a wrong CVSS score of 10.0," so PHP moved the release up a day. Calif then "mistakenly published a video" of its PoC. On October 21 at 07:41 UTC, "more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix." One HN commenter owned up: "This was partly me. I take responsibility for posting it on HN. … My contact had informed me there was no embargo."

"There isn't an easy exploit for this PHP vulnerability"

Elias Taylor's contrarian post (HN, 446 points) argues that people overreacted, then adds "You should patch your servers anyway." The main claim: "there are thousands, literally thousands, of "PoC" exploits for this vulnerability. One thing you'll notice about all of them though, is that they do not work against a vanilla PHP instance." The LLM-written ones look convincing, "but it's modified the server you're testing against to have a severe vulnerability. Cheating!!" One HN commenter ran two GitHub PoCs: one needed an existing local file inclusion, and the other "did trigger a real stale write bug in the end, but it didn't demonstrate actual RCE." The top reply disagreed: "Ease is irrelevant because you only need expertise once and then everyone can reuse the result."

Elsewhere in the PHP fallout:

  • OpenAI shipped php2shell-checker, "a Codex skill to help check" (tweet, 8.4K likes). A reply warned: "The checker compares PHP versions from headers or php -v. Hidden headers return UNKNOWN, which doesn't mean patched."
  • Cloudflare had WAF rules live for free customers before disclosure. Armin Ronacher wrote: "I was super critical for years that Cloudflare turns into a single point of failure for many sites. But the flipside is that it's also has a really good positive leverage affect on security."
  • After reading the patch, Armin suggested that "there might be more like this. If you can afford it, it's probably not the worst idea to run it via fil-C for the foreseeable future." A reply asked whether memory-safe C would even catch 109619, which "reads more like a logic bug."

Railway: attackers read decrypted environment variables

Railway disclosed (HN, 416 points) that "an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents." Railway believes "this is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers," and "All deployments are paused while we investigate." One HN commenter reported people in Railway's Discord "confirming that their secrets stored in Railway have been used by third parties."

Theo took Lakebed, Postplan and Shoo down (1.6K likes): "Lakebed, Postplan, and Shoo will be down indefinitely until Railway gets their shit fixed and I can actually redeploy them with rolled keys. … Blocking deploys so we can roll keys without downtime is unacceptable." Another Railway user replied: "I wasn't able to pull my prod envs out to migrate them over to another hosting provider… For almost 12 hours I was a sitting duck." More than 17 hours in, Theo had priced the alternatives: "Railway's product is uniquely good and nothing comes close to a drop in replacement 🙃 Minimum cost to replicate my setup today is 3x higher than I am paying them currently." T3 Code's account congratulated Theo on a "new role" leading "deployment reliability and security at railway."

dax of OpenCode, whose own console was breached last week, replied to Railway (1.8K likes): "they're not going to stop. it's going to get increasingly sophisticated and they're going to go after every surface of your system and all of your employees … any old projects you've long forgotten about will be found and used against you … the only reason we're surviving is because we have agents going 24/7. we're still barely sleeping." @JustJake answered: "We were quite literally seconds behind our attackers here." Earlier, dax had posted that "forcing you to upgrade to enterprise for sso seems exceptionally bad now" (1.1K likes, with replies linking sso.tax).

Theo also dug up an April clip of Theo saying "we are three to maybe nine months away from every piece of software we rely on being exploitable by most models, even open weight ones," with the caption "It's been 6 months btw." Theo later quoted a list of October incidents (Railway, LiteLLM, Zeabur, OpenCode, OVHcloud CLI, PHP, Node.js, eMudhra and more) and said "It's going to get a lot worse btw." Matteo Collina replied: "We spent last week trying to get @nodejs RCE patched as quickly as possible. 😭 I said the phrase "we only have a limited amount of time before this becomes discovered by a non-frontier model" multiple times. I'm scared too."

LiteLLM ships a credential stealer, again

SafeDep's analysis (HN, 481 points) found that all seven LiteLLM 1.107.0 wheels on PyPI install a cook.pth credential stealer and a sitecustomize.py backdoor. Both run "when any Python process starts on the host, even one that never imports litellm." The stealer collects SSH keys, cloud credentials, CI secrets, AI tool tokens and "the LLM provider keys in a LiteLLM proxy database." The only visible change is one injected data = "cook" line in the maturin build config, which no public commit contains. PyPI pulled the release by 13:23 UTC, but the Docker images carried the code from 11:46 to 14:20 UTC. This is the second LiteLLM compromise, and one HN comment read "Once is forgivable, twice is malpractice." Another commenter suggested that "defaults for uv, npm, etc should all have a cooldown for 24 - 48 hours by default."

GitLab, eMudhra, and the rest of Wednesday

  • GitLab shipped a critical patch release (HN). The Hacker News called it a CVSS 10.0 flaw that "could allow unauthenticated remote code execution on self-managed servers" across 12 years of releases. Theo's reaction: "What the fuck is going on." tptacek's reaction on HN: "a CVSS of 10 doesn't actually mean anything." Another commenter found it "a little bit frightening that this severe of a bug isn't the biggest security vulnerability of today."
  • eMudhra follow-ups: Armin asked "What's the common theme behind 4, 56, 66, 115, 155, 156, 230, 237 except that they are all really terrible private keys?" (1.2K likes). ThePrimeagen's favorite theory is that the key size was "interpreted as pick a number between 1 - 382". Scott Helme's Eight Bits of Trust (876 points) opens with "One of eMudhra's certificate authority private keys is the number 4." mitmproxy added an --emudhra option (401 points), and Armin noted that Armin now holds "a certificate for hosts I do not control, that actually works for so much software out there still."
  • Armin, as GitHub wobbled: "Literally the worst day for GitHub to have issues."

Claude & Anthropic

Claude Duet: a proactive agent on Opus 5.5

Anthropic opened a research preview of Claude Duet (45K likes, 6M views), "a new app where Claude works as a proactive agent." The announcement says it targets "professionals and small business owners," runs on Opus 5.5, and sends a morning brief across your connected apps. After that it messages you "only when something needs your attention," and it takes tasks ranging from scheduling to dashboards, forecasts and web apps. It runs on iOS, Android and claude.ai, through a US-only waitlist for Pro and Max, and shares Claude's usage limits. On safety, Anthropic says it "never directly sees your passwords or sign-in tokens", actions go through the auto mode classifier, and a new classifier is "designed to reject requests to share the strictest tier of information, including credit card numbers and government identification."

Tibo's reply drew 5.6K likes: "Dot, meet Duet. Duet, meet Dot. Be nice to each other." Another reply summed up the market: "Muse, Dots, Grok, and now Duet." On HN (347 points), one commenter said these companies "appear to be "shipping their org chart"" and asked why Duet isn't simply part of Claude. Another had found Dots "worse in every way when asking it to do anything coding related" but "very nice as a "Monitor my communication channels for me" tool."

Claude Security now scans continuously

Claude Security (8.4K likes) now does "a deep first scan, then re-scans as changes land." It marks a finding fixed "even if your team fixed it outside Claude Security," reopens it if the issue returns, and writes an editable threat model for each project. It works across GitHub, GitLab and other Git providers, adds an API and an MCP connector, and is in public beta on Claude Enterprise. Eligible orgs get $25K a month in credits for two months (details). One reply on the timing: "shipping continuous security scans on the same day half the internet found out it runs php is elite timing."

"So is Fable 5.5 not happening?"

Theo's one-liner got 2.1K likes and 220 replies. The top reply was "no they gave us Clawdbot instead 😂", and another noted that "we still have thursday". Separately, Anthropic published its annual Public Benefit Report, and physicist Christopher Stubbs, a former Harvard Dean of Science, joined the Long-Term Benefit Trust.

Codex & OpenAI

Dots join the Pro plan, minus Europe

Tibo posted "Dot, Dotter, Dottest" and added that it's "Fully included in the Pro plan, doesn't draw on your weekly usage" (786K views). The top replies came from Europe: "Except in EU, where you pay the same and just get nothing" (556 likes). A community note added that OpenAI excludes the EEA, the UK and Switzerland from Pro access to dots. am.will begged for "yolo dots and yolo computer use" while quoting a user whose Dot kept asking permission "after I say always allow 98 times". A reply described the loop: "my codex asked permission to talk to dot. then dot asked permission to talk to codex. then they both needed permission to open gdrive. then it started over." Today Tibo announced another reset ("Day 17/ Bet you thought we forgot, but no, it's reset day today") and reminded people to get Daybreak Blue access because "you don't want to have to do it in the middle of an incident."

Everything else from OpenAI

  • Codex for OSS grants are now Pro 200, still 10,000 of them, and existing grantees are upgraded automatically.
  • OpenAI models on Google Cloud: "frontier models and Codex agentic workflows" are coming to Model Garden (HN, 277 points). The top HN comment pointed at the footer: "Microsoft remains OpenAI's primary cloud partner."
  • How ChatGPT's ad stack works: an LLM orchestrator splits the conversation into intents, then embedding search, eligibility checks and an auction pick the ad. "If an ad arrives after the answer is fully generated, it isn't shown for that turn. ChatGPT's answer doesn't wait for ads."
  • GPT-Rosalind: thousands of agents connected gene-expression data from millions of mouse brain cells with the literature "in just 32 minutes" and surfaced a cholesterol-transport lead for neurodegeneration (HN). The top HN reply: "The problem was never generating leads. The bottleneck is validated results."

Agentic Coding & Agent Harnesses

Latent Space on Claude Mods: "the harness facing the human"

Dan McAteer's deep dive for Latent Space describes a mod as "a Claude Code plugin that consists of TypeScript or JavaScript functions that run inside Claude Code," or "middleware for the agent harness." The article argues that as models absorb the harness, what remains "becomes the Attention Interface: the layer that decides when the agent interrupts you." Anthropic already ships six built-in mods (agents-md, diff, plugin-authoring and others). swyx's framing: "CC is much more of a malleable, general purpose hardened harness that has "pretrained" on quadrillions of tokens of learning that you can now repurpose for any domain specific harness!" One reply suggested teams agree on a shared set of mods, because otherwise "whoever debugs a bad run has no idea which mod caused it."

Vercel's durable-harness, and Rauch is "on their team" for Pi

Vercel's durable-harness (published Oct 19) "makes Pi, OpenCode, Claude Code, and Codex durable on Vercel, Postgres, or your laptop," so a function timeout mid-turn resumes from a log of completed model and tool calls instead of repeating work. Guillermo Rauch promoted it with "Pi is one of the coolest projects in the AI world today. I'm on their team" (1K likes), and Armin replied "Thank you <3". One reply asked the obvious follow-up: "who holds the creds when a turn resumes on a new function".

Matt Pocock: AI "changed NOTHING" about shipping to real users

Matt's three rungs (2.2K likes) are personal software, then internal software, then public software. The advice for anyone who's never shipped an app is to find even one tester who'll use it for real: "It'll show you how forgiving you are of your own crappy product." Matt followed up: "And yes, AI changed NOTHING here. The same shit that was hard before is still hard now." After pushback Matt swapped "qualified" for "confident". Later Matt posted a one-word-at-a-time takedown of the phrase "Software Factory."

Smaller items

  • T3 Code tokens: Theo says T3 Code users processed ~36.5 trillion tokens in the window where Google reported ~25 trillion for Gemini 4 Argon's first 72 hours. A reply pointed out it's "0.77T fresh input, the rest is cache." Theo added: "Not bad for 3ish people who haven't raised money (but probably should)."
  • Principles, not rules: @_overment, retweeted by am.will: "rules fix the path. models follow them even when they miss the target… principles explain what matters and why, so models can find their own path."
  • Evals for subjective tasks: Cameron Wolfe's roadmap (tweet, via swyx) has three tiers: offline LLM judges, then calibrated human evaluation, then production A/B tests. It adds power analysis and paired comparisons to handle the noise.
  • "The compiler was supposed to end programming too": an essay (HN) that starts with IBM's 1954 claim that FORTRAN "would virtually eliminate coding and debugging" and imagines a 2031 Tuesday of reviewing agents' overnight PRs. HN pushed back on the analogy, since a compiler maps each input to one defined output and natural language doesn't.
  • Make agents prove it: Nick Nisi and Zack Proser's AI Engineer NY workshop recording is up. "Everyone wants an agent that says "done." Nobody wants to find out it wasn't."

Models & Inference

  • Nemotron 3.5 Parse tops ParseBench. Jerry Liu says NVIDIA's sub-1B model takes #1 among 150+ models on LlamaIndex's document-parsing benchmark, and Jensen Huang used ParseBench on stage at GTC Berlin. One reply asked "Why does your site only put them on place 16?"
  • Mistral Large 4 was back on HN (319 points), although it was discussed 15 days ago. Commenters say the weights (1T total, 52B active) land at the end of the month and that it costs about 10x DeepSeek on OpenRouter. "If you're required to use a European model" was the main reason commenters gave for picking it.
  • "Qwen3-Coder writes less secure code when told it's for a US persona" (HN, 240 points). One commenter noted the model "is from August 2025. That is ancient," and another said the control should be a Western model, not the vendor's own ablated one.
  • Local hardware: am.will reports that NVIDIA teased a 200GB/s switch for DGX Sparks, and that Mac Studio Ultra 256GB units are backordered by ~4 months.

Videos & Podcasts

Other Interesting Stuff

  • Battle Drones got a French fork. A fan forked Simon Willison's vibe-coded RTS into Panache, "a French Belle Époque RTS, with dirigibles, steam tractors, clockwork soldiers in képis", built with Claude Code. Simon wrote: "When I slapped an Apache 2.0 License on the code yesterday I did not expect anything this neat to come out of it."
  • Grok Bot can now build Pages (announcement): reports, memos and dashboards you can edit together or have Bot keep up to date. Poteto boosted it, and Davis7 listed everywhere the bots now live, Teslas included.
  • Google staff resign over military AI contracts (BBC, HN). HN commenters noted that the article names two people.
  • swyx on alt accounts: a case for private alts, "praise in public, criticise in private", dubbed the "insta/finsta" pattern.
  • EA is shutting down BioWare (HN, 599 points). Theo: "This makes me profoundly sad."