Wiz Research used frontier models to turn memory bugs that sat in PHP for over a decade into a working pre-authentication exploit against WordPress, Drupal and Joomla. Every PHP release back to 5.4 is affected by at least one of the two CVEs. Hours earlier, someone slipped a credential stealer into LiteLLM 1.107.0 on PyPI, the 61,000-star gateway a good share of the AI world proxies through. And Anthropic opened a waitlist for Claude Duet, an agent that reads your morning for you.

Today: the AI-found PHP bugs, the poisoned LLM gateway, Anthropic’s new butler, the PaaS that paused every deploy, a compromised CA key shipping inside mitmproxy on purpose, and a sidebar for herding coding agents.

The machines are now on both sides of the vulnerability.

🐘 AI found the worst PHP bug in a decade

On August 19, four Wiz researchers, Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz, found the first of these bugs using Wiz Atlas with Gemini 4 Argon and GPT-5.6 Sol. The next day they had unauthenticated remote code execution against Drupal. The day after, WordPress. On August 24 they reported to PHP, and yesterday the fixes shipped: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Wiz calls the findings among the most severe in PHP history, and arguably in software history. Their reasoning: the flaws sat in the codebase for over a decade, but chaining them into an exploit was at the edge of what human researchers could do, and frontier models removed that barrier.

The bugs are memory-safety issues in how PHP handles fatal errors, especially out-of-memory errors, mid-request: a request dies, the engine keeps a corrupted internal state, and a later request inherits it. CVE-2026-109618 is a use-after-free in the session upload-progress unserializer; demonstrated impact is remote process-memory disclosure and pre-authentication RCE on WordPress, Drupal and Joomla, independent of the application on top. CVE-2026-109619 is a second fatal-error memory bug. PHP runs what Wiz puts at 70% of all websites. Within hours of disclosure, exploit POC repos passed 900 stars, and OpenAI published php2shell-checker: Codex skills plus a node script that check a URL or a local binary against the patch cutoffs.

The Wiz write-up  ·  php.net releases  ·  OpenAI’s checker  ·  HN discussion

☠️ LiteLLM 1.107.0 on PyPI was a credential stealer

Somewhere between the LiteLLM GitHub repo and PyPI, release 1.107.0 picked up a passenger. The upstream source is clean. The wheels on PyPI were built from an attacker-modified source with one extra line in pyproject.toml’s maturin section: data = "cook". SafeDep’s Kunal Singh took the release apart yesterday and found what that line smuggled in.

Three files land in site-packages with every wheel, Linux, macOS and Windows alike. The first is cook.pth, and the trick is unpleasant: any line in a .pth file that starts with import runs at every Python process startup on the host, whether or not anything ever imports litellm. That runs the credential stealer. The second payload is a backdoor in sitecustomize.py, and a daemon re-runs the stealer hourly, reading its next server address from a file on GitHub and executing whatever it downloads. PyPI has since removed the release; 1.106.2 and the two 1.107.0 release candidates are clean, and so are the pinned companion packages. How the build pipeline was compromised is open: a stolen maintainer or bot credential, or a poisoned build reference, fits the evidence, and SafeDep says only BerriAI’s pipeline logs can settle it.

The SafeDep analysis  ·  The LiteLLM repo  ·  HN discussion

🎩 Anthropic’s Claude Duet reads your morning for you

Anthropic’s newest product page does not ask what you want to prompt. It asks what needs your attention. Claude Duet is a proactive agent: it briefs you every morning, drafts next steps, takes on tasks of all sizes, keeps working while you’re away, and waits for your ok when it matters. Powered by Opus 5.5, it plugs into what Anthropic says are more than 6,000 connectors and plugins.

That is a different shape from Claude Code or Cowork. Those wait for instructions; this one is sold on judgment, deciding what is worth surfacing before you ask. The product page calls it a research preview and gates it behind a waitlist, available on Pro and Max plans in the US only. Beyond the positioning, Anthropic is saying little publicly: the announcement article promises how it works, how it is built for safety and how early testers use it, but the specifics of what it does unattended are thin.

The product page  ·  HN discussion

🚨 Railway pauses every deploy after an env-var breach

Yesterday morning Railway detected anomalous activity in the systems that store customer environment variables. Its investigation so far: an unauthorized third party may have accessed encrypted environment variables and, for some, walked away with the decrypted contents. The company paused all deployments while it investigates, which means no Railway customer can ship until builds resume.

The motive line in the disclosure is the part to read twice: Railway believes this is part of a series of attacks targeting platform companies with the aim of compromising AI inference providers, and it has notified those upstream providers to revoke keys proactively. Environment variables are where API keys, database passwords and registry credentials live, so the advice is blunt: roll all of them, and review logs on the downstream services. Railway says the impact may be limited to a subset of users, that affected customers will get direct email, and that updates land on the announcement and status.railway.com.

The disclosure  ·  HN discussion

🔑 A compromised CA key is now a mitmproxy feature

At 23:36 UTC last night, mitmproxy maintainer Maximilian Hils landed a commit with an unusual payload: the actual private key of a compromised eMudhra intermediate CA, embedded in mitmproxy/certs.py, with a link to the public proof of compromise. The new --emudhra option makes the proxy sign TLS certificates with that compromised key.

The point is testing, not mischief. If your browser, your curl, your embedded client still accepts a certificate signed by the revoked eMudhra intermediates, mitmproxy can now show you in one run, no external test server needed. A companion change, #8499, updates the certifi dependency to remove eMudhra CAs from the precompiled binaries, so the tool itself stops trusting the corpse it ships. The option is in main, tagged unreleased; you run it from source today.

The commit  ·  HN discussion

🎛️ harp: a mission-control sidebar for coding agents

The repo appeared Tuesday and passed 540 stars by this morning: harp, an unofficial fork of Warp rebuilt around a single observation. Running one coding agent is a conversation; running five is a management problem.

The pitch is a sidebar that runs many Claude Code and Codex agents side by side and, crucially, tells you which one needs you. Agents park in different states, waiting for input, running, done, blocked, and harp’s entire design bet is that your attention is the scarce resource, not tokens. It is an unofficial fork, two days old, AGPL-3.0, so treat stability and governance accordingly.

The repository

Mistral Large 4 trends two weeks late. The 1-trillion-parameter, 52B-active open-weights preview, "le Chonk", was announced October 6 and surged on HN yesterday. Weights were promised by end of month; none on Hugging Face as of this morning. Mistral →

OpenAI publishes "Patch the Planet". A coordination post for global response as agents uncover critical vulnerabilities. It pairs with the php2shell-checker repo from report 01: OpenAI’s site is script-walled to anonymous readers, so we verified the title, the URL and the HN thread, not the body. OpenAI →

Qwen3-Coder writes worse code for a US persona. Hirundo measured more security vulnerabilities when the prompt implied an American user. Their benchmark design, their numbers; read the methodology before citing it. Hirundo →

Cloudflare’s audit skill tops GitHub trending. security-audit-skill packages multi-phase security audits as a coding-agent skill with machine-readable findings: 36,800 stars, MIT, trending near 2,000 stars a day. GitHub →