Twelve security incidents in ten days

Companion to this week's special edition of the newsletter. Facts current as of Thursday, October 22; several of these incidents are still being investigated and the details will change.

The list

PHP2Shell (October 20 to 21). PHP is the programming language under almost 70% of websites, WordPress included. Two flaws let an attacker run code on a server with one request and no login, before the site's own code runs. They had been in PHP for decades. OpenAI says a research group called Calif found them in August using one of its models, and Wiz found them independently with AI help. The fix was due October 22; details leaked on October 20 and PHP shipped emergency updates on the 21st (8.5.12, 8.4.27, 8.3.36, 8.2.35, with backports for 7.4 to 8.1). Amazon's honeypots recorded an exploit attempt on October 17, four days before the patch. Cloudflare added temporary firewall rules, free plans included. As of Thursday no successful break-in had been publicly confirmed. The NSA and the UK's NCSC both said to update now or take the server offline.

eMudhra certificates (October 17 to 20). A certificate authority is a company browsers trust to vouch that a website is who it says it is. Eight of eMudhra's signing keys were generated so badly that they could be recovered by a researcher. Chrome and Firefox blocked them on October 17, Apple on the 19th, Microsoft on the 20th. eMudhra says none of the eight issued customer certificates and there is no evidence of abuse. Some software outside browsers may still trust them.

Zeabur (October 14 to 15). A developer hosting platform. Attackers used old administrator credentials, missed in the cleanup after an August breach, to read about 3.2 million environment-variable records for about 320,000 accounts. Environment variables are where apps keep their passwords and keys. Zeabur is shutting down; services pause December 1 and stop December 31.

Railway (October 21). Another developer hosting platform. It said attackers "may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents," paused all deployments, and told every customer to revoke and replace every key. Railway called it part of a broader attack aimed at the companies that sell AI model access. Cause and scope not yet disclosed.

LiteLLM (October 21). A widely used open-source package that sits between an app and AI providers such as OpenAI and Anthropic. A poisoned version, 1.107.0, was on PyPI for about two hours and in the official Docker images. It ran every time Python started, whether or not the app used LiteLLM, and collected SSH keys, cloud credentials, CI secrets, browser passwords and AI provider keys. The release went out through three maintainers' GitHub accounts, apparently with stolen tokens. Anyone who installed it should assume everything on that machine is exposed; uninstalling does not undo the theft.

OpenCode (October 17). An open-source AI coding tool. A legacy system being shut down still held customers' saved OpenAI, Anthropic and Google keys; about 1.4% of Console users were affected, and some reported more than $1,700 in charges overnight. OpenCode calls it a distillation attack, meaning the stolen keys were used to harvest model output on someone else's bill. That motive is OpenCode's claim.

ConnectWise Cloud Backup (October 16 to 20). A backup product many IT providers install in their clients' Microsoft 365. One stolen application credential was pre-authorized in every tenant that had ever installed it, so the attacker could sign in to 173 companies' Microsoft 365 with the same key. ConnectWise disabled the application identities on October 17 and suspended the service. Disabling the connection does not reverse changes already made inside a tenant; some victims found the attacker had granted itself admin roles.

One hacker, 100+ companies (reported October 19). Reuters, citing the security firm Norforge, reported that a single Chinese-speaking person ran AI agents that tried more than 1,200 websites and broke into more than 100, including John Deere, SharkNinja and Cummins. The instructions were under 100 Chinese characters. Estimated cost: about $5,000 in AI tokens, about $50 per successful breach. The companies say the affected sites held no sensitive data.

CrowdStrike's four groups (October 22). CrowdStrike described four separate actors running break-ins through AI agents, one of which breached at least 15 Argentine healthcare organizations. One hacker told its agent, "You find the bypass yourself, don't rely on my help." CrowdStrike's conclusion: the limit on these campaigns is "not engineering complexity but token budgets."

Also this week: critical fixes for Next.js (two remote-code-execution flaws, October 14), Node.js, GitLab and Oracle Java, and an actively exploited chain in Plex Media Server.

Nobody has shown these are one attacker or one plan. They share a layer: the languages, certificates, hosting platforms and vendor connections every company sits on and almost no CEO sees.

What we did

On Wednesday afternoon, October 21, we prepared security updates across 12 codebases, four of ours and eight client projects, mostly for the Next.js advisories. Elapsed time across all 12 was under two hours. Eleven are merged; the twelfth is a retired codebase whose repository is archived. None of the code we maintain runs PHP, depends on LiteLLM or deploys to Railway or Zeabur; we checked every repository on Thursday.

Questions to send your IT team or provider

Forward as-is. Each one has a concrete answer.

1. Who runs our website and servers? Which PHP version are they on now, and when was it updated for PHP2Shell?
2. Where do our applications' passwords and API keys live? Which hosting platforms hold copies, and have all of them been replaced since October 21?
3. Did we install LiteLLM 1.107.0, or run its Docker image, on any machine between October 21 and now? How do we know?
4. Which outside vendors and tools have standing access to our Microsoft 365 or Google Workspace, and what can each one do? Is ConnectWise Cloud Backup among them?
5. Do any of our systems still trust the revoked eMudhra certificates?
6. Which of our web apps run on Next.js, Node.js or GitLab, and are they on this month's fixed versions?
7. Who can see our AI provider bills, and does every account have a spending limit?
8. When a critical patch comes out, how long until it is live, and who approves it?

A prompt to audit your own setup

Paste this into Claude, ChatGPT or Codex on the machine or repository you want checked. It reads and reports. It changes nothing and never shows a secret.

I want a read-only security audit of this machine or repository after the October 2026 incidents (PHP2Shell, LiteLLM 1.107.0, Railway, Zeabur, ConnectWise, eMudhra). Do not change, delete, rotate, install or uninstall anything. Never print, paste or echo the value of any secret, key, token or password. Report only names, file paths and locations. Check and report: 1. PHP. Is PHP installed or used here (php binary, composer.json, Dockerfiles, WordPress)? Report every version. Flag anything below 8.2.35, 8.3.36, 8.4.27 or 8.5.12. 2. LiteLLM. Is the Python package litellm installed in any environment, requirements.txt, pyproject.toml, lock file, Dockerfile or docker-compose file? Report every version. Flag 1.107.0, and any Docker image pulled from the litellm tags v1.107.0, latest, main-latest or main-stable on or after October 21, 2026. Report any files named cook.pth, cook.py or sitecustomize.py in a site-packages directory. 3. Where keys live. List every place API keys and cloud credentials are stored: .env files, CI/CD secrets, hosted platform settings (Railway, Zeabur, Vercel, Netlify, Render, Fly, AWS, GCP, Azure) and local credential folders such as ~/.aws, ~/.config/gcloud and ~/.ssh. Give the key name (for example OPENAI_API_KEY) and its location, never its value. 4. Hosting. Does any project here deploy to Railway or Zeabur? Check for railway.json, railway.toml, zeabur config, CLI configuration or deploy scripts. 5. Web frameworks. For every web app, report the Next.js and Node.js versions from package.json and lock files. Flag Next.js below 15.5.28, or any 16.x release below 16.4.1. 6. Rotation order. Based on what you found, list which keys to rotate first with a one-line reason each. Put first any key on a machine that installed litellm 1.107.0, any key stored in Railway or Zeabur, and any AI provider key with no spending limit. Give me a short report with sections 1 to 6.

The prompt runs where you paste it. It will not see other machines or a hosting platform's secret store, which is why the questions above go to a person.

What AI changed

Both directions at once. AI found the PHP flaws months before the leak, and AI turned decades-old bugs into working attacks faster than the old economics allowed. Attackers who could not write an exploit can now rent an agent that will, for the price of tokens. And the tools businesses are adopting concentrate their keys in a few packages and platforms, which is where several of this week's attackers went.

The defender's side moved too. A small team can prepare a dozen patches in an afternoon. What has not moved is the approval step, which still takes as long as the approver takes. Decide now who that person is at your company, and whether they can say yes within a day. Then put a spending limit on every AI account. It is cheap insurance against a stolen key.

Sam Gaddis