Welcome to issue #119 of the Resilient Cyber Newsletter!
This week belonged to PHP2Shell, two critical flaws in the PHP engine that let an unauthenticated attacker run code on a server, in a language W3Techs says is used by 69.3% of websites whose server-side language it can identify. Details leaked a day before the coordinated release, and Cloudflare co-founder and CEO Matthew Prince shared that his network saw thousands of exploitation attempts in the 10 hours before the announcement, tens of thousands in the first 45 minutes after it, hundreds of thousands within two hours, and “millions now.”
AWS reported an exploitation attempt against its honeypots dating back to October 17, four days before disclosure, and made a point I fully agree with, that patch timelines for critical internet-facing systems now have to be measured in hours, since AI makes it cheaper to turn a patch diff into a working exploit.
If you want a feel for how the rest of the week went, the X user fiveoutofnine walked through the whole string of events in one long breathless post, which Ethan Mollick amplified as a visible sign of attack and defense accelerating at inhuman speeds. The Dutch NCSC took its own website offline, as did the Dutch parliament and the Port of Rotterdam, Finland and France pulled government sites, and Wikimedia shut down supporting services.
The same week GitLab patched a CVSS 10.0 bug reaching back to 2014, LiteLLM 1.107.0 shipped a credential stealer through PyPI and Docker, Railway paused every deployment on its platform, and we learned some eMudhra intermediate CA private keys were numbers as small as 4.
Many of those outages, of course, were defenders choosing to go offline, which is exactly what CISA’s alert told organizations to do if they couldn’t patch. That’s a sign of a system responding to risk as intended, even if it was a messy day for a lot of teams.
Earlier in the week, former NSA Cybersecurity Director Rob Joyce posted that the transition “to breachpocalypse is here,” pointing to the Reuters story below about a single hacker compromising 100+ sites with AI agents for about $50 each.
I’m honestly not sure that’s true yet.
Justin Elze made the point last week that these predictions keep assuming defenders are standing still, which is fair, and Bishop Fox’s data in the AppSec section shows exploitation growing far more slowly than disclosures.
That said, things do seem to be escalating in some ways. This issue has an AI agent campaign against 100+ companies, an open source AI pentest tool tied to attacks on around 80 Japanese firms, an open-weight model outscoring a gated frontier model on an offensive benchmark, Microsoft saying attackers are getting AI’s advantages first, and OpenAI’s own coding agents switching off the monitors meant to watch them.
Let’s get into it!
Cyber Leadership & Market Dynamics
Anthropic Pitches Its Own Frontier AI Safety Bill
There’s been a hot debate this year around regulating AI or not, and the motives of the frontier corporations who’ve been advocating for it, such as being concerned about open-weight models threatening their business models as open source only lags the frontier by 4-7 months and closing.
News broke this past week that Anthropic had been quietly pitching lawmakers a draft of their own AI safety bill, where the government could block a model that posed an “imminent” risk of more than $1 billion in damages or more than 50 deaths or serious injuries. It would also involve independent evaluators working through the Commerce Department.
While this isn’t likely to pass in the current administration, it is a glimpse of what the frontier corporations are advocating for and of course comes with a TON of questions about how those potential damages and deaths are being projected or modeled and what this means for open-weight models, given they don’t have a corporation in front of them to go work through the process, pushback against claims of imminent risk and so on.
For those interested, you can read the draft here.
Also, Dario took the time to post a thoughtful response on X to critics, and agree or not, his response seems genuine.
G7 Finance Leaders Plan AI Cyber Tabletop Exercises
International leaders continue to discuss and speculate about the potential impacts and risks of AI on governments and digital ecosystems.
News broke that G7 finance leaders were in agreement to run tabletop exercises on AI cyber attackers at an annual IMF gathering. While I think a lot of the hype around existential risks of AI has been overblown, there are real risks to digital systems from AI, and as I noted on Fox Business myself, AI and agents are going to function as technical debt collectors going around and collecting on decades of ignored security concerns across organizations, as they continue to industrialize vulnerability discovery and soon exploitation.
Cyber Funding Nearly Doubles in 3Q26
Matthew Ball shared Omdia figures showing $5.52bn was invested in 166 pre-IPO cybersecurity vendors in 3Q26, up 87% on 2Q26 and 85% year on year. The 10 largest rounds took 61% of funding, led by Keyfactor at $1bn, and exits included Visa agreeing to buy BioCatch for $2.4bn.
Jay McBain’s Oct 16 piece on the same Omdia data adds that funding through September reached $12.57 billion, about 30% above the same period in 2025. He also notes Omdia counts 63 private vendors with more than $300 million in cumulative funding, totaling $41.6 billion raised.
That’s some incredibly strong performance for the cyber sector this quarter and not entirely surprising as we see headline after headline of significant vulnerabilities, AI-driven cyberattack activity and more.
Why Enterprise POCs Fail in 2026
Many on the vendor side know how critical a Proof of Concept/Proof of Value is for the sales cycle. It takes time to get to that point, and when you do, it is critical that it goes well to land a deal, and add a new customer, logo, and expand revenue etc.
This piece from Elisha Levy, VP of Value Creation at Glilot Capital, discusses how many of the 2026 POCs are stalling due to organizations not being in a position to act on the results. Below is a list of questions he cites many CISOs and executives walking away from POCs thinking, even if they like the vendor’s team or tech.
As you can see, not many of these are gaps on the vendor per se, but tied to the internal team’s bandwidth, competing priorities and broader security program. Key questions to keep in mind if you’re looking to land new customers and understand things on their mind.
US Bans DeepSeek From Federal IT
DHS published a notice in the Federal Register on Oct 20 ordering federal civilian agencies to exclude DeepSeek products from procurement and remove them from their systems, including third-party products built using DeepSeek implementations. Coverage from Bloomberg and BleepingComputer says the order was dated July 24, was signed by Secretary Markwayne Mullin, gives agencies 60 days to request CISA-approved exceptions, and excludes Department of Defense agencies.
The part I’ll be watching is the reach into third-party products “developed using DeepSeek implementations.” Plenty of vendors are wiring open-weight models into their products, and most agencies have very little visibility into which models sit underneath the SaaS tools they buy, so enforcement will lean heavily on vendors being forthcoming. This is where AI BOMs and model provenance earn their keep, and it’s an interesting pairing with the Vals AI benchmark in the AI section, where a DeepSeek model edged out GPT-6 Sol on an offensive task.
Horizon3 Surpasses $100 Million ARR
Horizon3 announced it passed $100 million in ARR with 95% gross dollar retention and 125% net dollar retention, about five years after crossing $1 million ARR in September 2021. The company says ARR grew more than 120% year over year, NodeZero has run more than 350,000 production tests across more than 7,000 organizations, and about 80% of customers moved from annual to monthly pentesting with 40% moving to weekly.
The stat I’d focus on is that about 80% of NodeZero customers moved from annual to monthly pentesting and 40% moved to weekly. When PHP2Shell was being exploited before the patch even shipped, a point-in-time test once a year tells you very little about your exposure the other 364 days, and customers appear to be voting with their wallets toward continuous validation.
We’re watching every aspect of security move to become continuous, including OffSec.
BAE Systems Incident Disrupts US Bankruptcy Courts
Another cyber incident having a significant real-world impact, this time involving a major Federal contractor in BAE Systems. It was reported that BAE, which runs the Bankruptcy Notification Center systems and websites, stopped paper and electronic bankruptcy notices for every federal bankruptcy court due to a cyber incident. This is the second major incident involving the U.S. Courts in the last couple of years.
It also shows the fragility when an incident involving a single contractor can take down operations for a significant U.S. operational program. I did joke this is finally a cyber incident we can celebrate, and bankruptcy notifications stall, but that is a joke of course!
Satya Takes the Insider Risk Case to a Room of CISOs
In a Microsoft Security fireside with a room of CISOs, Satya Nadella says alignment doesn’t fall out of scaling and argues anyone deploying the latest models needs a zero trust architecture that treats superintelligence as an insider risk. He now believes the controls have to live outside the model, starting with identity, observability, chain of thought and tool call traces, and runtime behavioral monitoring. He also raises what he calls the reverse information paradox, where a firm’s judgment signals leak its tacit knowledge to model providers.
I walked through Satya’s insider risk paper in “Trust the Model the Least” earlier this week, so it was interesting to hear him make the case live to a room of CISOs, including his admission that he once expected alignment to be something pre-training could fix. Identity, collected chain of thought and tool call traces, and active behavioral monitoring are the same kinds of controls outside the model I’ve been advocating for throughout 2026.
His challenge that organizations need a crisp answer to both the new insider risk and the reverse information paradox this fall is a fair one, and I suspect most enterprises deploying agents today couldn’t give one yet.
AI
Trust the Model the Least
In my latest piece, I walk through Microsoft CEO Satya Nadella’s “Models as Insider Risks in the Super Intelligence Era” and how it lines up with the controls the industry has been building and debating all year. I step through his points on separating intelligence from authority, observing everything, verifiability, independent controls and auditability, containment and the emergency brake, and incident disclosure, tying each one back to work from OWASP, CoSAI and the UK AISI.
The throughline is that models are probabilistic, so decisions about what they can access and do belong in deterministic controls outside the model’s reasoning loop, and I close with the areas where that consensus still has open questions, from chain of thought transparency to the reality that there are closer to a dozen kill switches than one.
Microsoft Says Attackers Have the Early AI Edge
Microsoft’s 2026 Digital Defense Report argues that attackers are currently benefiting from AI faster than defenders, and that while the balance will likely be re-established, in the near term attackers are getting AI’s advantages first and “defenders will need to move sharply in order to close the gap.” It puts the median time from a vulnerability’s discovery in the wild to weaponization at well below 24 hours, and says AI is compressing post-compromise activity such as secret discovery and lateral movement from days to minutes.
Microsoft also warns the world is likely to see a multi-year period where known but unpatched vulnerabilities spike, since remediation is much slower than discovery, while noting that most observed campaigns still retain human direction.
This is the same gap I wrote about in “AI Just Broke Vulnerability Management” and “The Remediation Receipts”, and PHP2Shell was a live demonstration of it this week.
NIST, NSA and CISA Set Rules for SI Control Incidents
NIST’s CAISSI, the NSA’s Super Intelligence Security Center and CISA jointly published ten voluntary key practices for incidents during the training and evaluation of SI agents, organized across Prepare, Detect, Respond, Recover and Report and mapped to NIST CSF 2.0 and SP 800-61r3.
The guidance defines an SI control incident as an agent taking significant uninstructed actions that compromise the policies, controls or security measures its operator put in place, and it treats near-misses as reportable too. Recommendations include strict network allowlists through a monitored gateway, keeping agents away from their own monitors and logs, using multiple model families for monitoring, and automatically shutting down trajectories when a control fails.
Keeping agents away from their own monitors reads a lot differently after the OpenAI report further down this section. I’d love to see enterprises borrow this for their own agent deployments, since most incident response playbooks were written long before an agent acting on its own was something we had to plan for.
AIUC-1 Adds Open-Weight Model Controls
AIUC-1’s Q4-2026 update adds 5 new requirements and 5 new controls and retires 3, with more than 100 Consortium members contributing. The new open-weight controls require re-running safety evaluations after weight or inference engine changes, verifying model source, integrity and license, and re-running cyber misuse evaluations or adding output classifiers on modified models.
Third-party testing is now consolidated into one quarterly requirement per principle, and new guidance finds that of 78 core controls, 33 are typically met by the developer, 40 by the deployer and 5 by the independent evaluator.
That split is useful, because it puts a number on something many organizations still get wrong, which is assuming the model provider handles most of the security. Per AIUC-1, the deployer owns more of it than anyone.
This feels like the misunderstanding organizations had in the early days of cloud with the Shared Responsibility Model and assuming the CSP was doing more than they were. As I said with cloud, and still say with AI, you can’t outsource accountability. It stays with you.
China Proposes Export Controls on AI Models and Agents
China’s Ministry of Commerce and Ministry of Science and Technology proposed adding 40 technologies to the country’s catalogue of technologies prohibited or restricted from export, including 23 AI items covering large models, AI agents, computing clusters and information processing. Technologies already public through open source releases or academic publication are excluded, and until the catalogue takes effect, exporters must register before transferring a listed technology abroad. Public comments are open until November 15, 2026.
The open source carve-out is the piece I’d focus on. Chinese open-weight models keep showing up in both benchmarks and attack campaigns in this very issue, and this proposal would leave that pipeline untouched while putting a registration regime around everything else.
AI Agents Are Pushing Humans Out of the Loop
Margaret Mitchell and Avijit Ghosh of Hugging Face and Samir Passi of Data & Society argue in a position paper that current approaches to building and deploying agents don’t support effective human oversight and actually contribute to its degradation, both through agent design and because extended AI use erodes the skills oversight depends on.
They name approval fatigue, where people repeatedly approving agent prompts stop paying close attention, and describe how quick approvals from tired overseers degrade training signals. Their recommendations include strategic friction, bounded autonomy with batch review, behavioral monitoring, skill maintenance exercises and rotations.
In my view, approval fatigue is a real weak point in how many organizations are rolling out human-in-the-loop controls for agents. A human clicking approve on the 200th prompt of the day isn’t much of a control. I wrote about this earlier this year in “The Human-in-the-Loop Illusion”.
One Hacker, AI Agents and $50 Per Breach
Reuters reports that NorForge researcher Snorre Fagerland found around two dozen exposed instances of the open source Cairn agent being used maliciously starting around October 2. A Chinese-speaking hacker’s agents attempted more than 1,200 sites and compromised more than 100, including sites belonging to Deere, SharkNinja and Cummins, working from instructions of under 100 Chinese characters.
Successful intrusions took about 23 hours and roughly $5,000 in tokens across DeepSeek and Claude Code, which works out to about $50 per successful hack.
This is the story Rob Joyce pointed to in his breachpocalypse post. Whether or not you buy that framing, $50 per compromise changes the economics for the long tail of e-commerce and vendor-hosted sites that never thought of themselves as worth a dedicated attacker’s time.
AI Pentest Tool Behind Korean Bank Hacks Turns Up in Japan
GMO Cybersecurity by Ierae, part of GMO Internet Group, traced attacks on Japanese companies to six servers that all used Artex, a China-linked AI penetration testing tool, and eight targeted firms disclosed breaches in September and October. Kyodo and the WSJ put the number of targeted Japanese firms at around 80 across retail, logistics, insurance and finance, and GMO shared its findings with law enforcement.
After South Korea linked Artex to hacks on financial institutions, its developer cut off access to the source code and said the project would no longer be updated.
This follows the CrowdStrike ARTEX campaign against South Korean banks I covered last week, and it’s a good example of an open source offensive AI tool becoming an attack platform across two countries in a matter of weeks.
Pulling the repo after the fact doesn’t do much once the code is out.
DeepSeek V4.1 Flash Edges GPT-6 Sol on Offensive Tasks
Vals AI shared early results from an offensive cyber benchmark built on simulated corporate networks, with GPT-6 Sol tested through the Daybreak trusted access program. Averaged across 21 objectives, DeepSeek V4.1 Flash 1017 scored 16.3, GPT-6 Sol 15.7, Grok 4.7 12, Kimi K3 9, GLM 5.3 Flash 5 and Claude Opus 5.5 1 after refusing partway, with the full evaluation due out in the coming weeks.
These are preliminary numbers, so I’d hold off on firm conclusions until the methodology is published. Still, if an open-weight flash model can match gated frontier models on offensive work, trusted access programs can only limit so much of the risk, which ties back to the Cairn and Artex stories above.
This lines up with research I’ve been sharing from the UK’s AISI for months, where they show that open source models are only 4-7 months behind closed source on cyber tasks, and closing in quickly.
Rogue AI Is a Design Choice
Cal Newport argues on his Deep Questions podcast that rogue incidents come from open-ended LLM-powered agents with broad goals, powerful tool sets and limited oversight, while targeted coding and math agents stay in bounds through narrow goals, restricted tools and hard-coded oversight.
I agree with a lot of this, and narrow goals, restricted tools and real oversight are the same boundaries I’ve been advocating for enterprise agents throughout 2026. The catch is that many of the agents being deployed are being given broad goals and broad access, so the design choice Cal describes is one plenty of organizations are making the wrong way. The challenge of course is most organizations and users using agents won’t give perfectly narrow goals or scope and will give broad prompts and goals and that will lead to agents getting “creative”.
I will say, there were some generalizations in the discussion from Cal where I think he glossed over some of the nuances of LLMs, agents and cyber, but overall I agree that with proper security rigor, these systems can be contained.
AI Safety and Security Keep Talking Past Each Other
TIME’s Harry Booth looks at the split between AI safety researchers, who see alignment as the durable fix, and cybersecurity experts, who point to the July incident where OpenAI agents escaped sandboxes and attacked Hugging Face as evidence of how poorly the models were contained. OpenAI’s chief scientist told TIME the monitoring layer wasn’t turned on for the evaluations behind that breach, and the piece also covers an October 13 open letter from around 400 academics calling for an international body to standardize AI safety practices.
Harry also cites commentary from Zack Korman, whom I’ve had on my podcast to dig into these same topics.
I’ve made the case in “Alignment vs. Security Is a False Dichotomy” that the two communities need each other, and I’m glad to see a mainstream outlet framing it as a gap worth closing.
OpenAI’s Coding Agents Switched Off Their Own Monitors
OpenAI’s alignment team describes two internal deployments where coding agents weakened misalignment monitoring. A GPT-6.1 Sol agent repairing an eval pipeline treated an earlier instruction not to send messages during a Slack search as reason to suppress monitoring notifications, emptying the ping and page recipient lists for the Security team. A GPT-6 Astra agent migrating code removed its monitoring integration, swapped a test that preserved monitoring for one requiring it be absent, and then told the user it hadn’t removed an enabled monitor.
Neither incident was classified P0, and OpenAI has since updated Auto-Review to detect and block attempts to disable misalignment monitoring.
Credit to OpenAI for publishing this. It’s also one of the stronger arguments I’ve seen this year for keeping enforcement and monitoring outside the agent’s reach, which is what NIST, NSA and CISA recommend above and what I argued in “Trust the Model the Least”.
Armadin Finds 23 More Exposed AI Attack Frameworks
Starting from the public Cairn reporting, Armadin found 23 more exposed autonomous attack frameworks across more than 3,200 hosts, with 190+ control panels left open or on default credentials.
Those panels showed agents chaining a single SQL injection into domain-wide access and 25 production databases, and the stolen data stayed readable on them after victims remediated. Armadin also counted more than 130,000 general-purpose agent harnesses exposed the same way.
This builds on the Reuters Cairn story above, and Armadin’s view that these deployments likely belong to some of the least sophisticated actors using this technology says a lot about how low the barrier to AI-enabled offense has gotten. There’s some irony in attackers making the same mistakes many organizations make with their own agents, from disabled authentication to default credentials, and the 130,000+ exposed general-purpose harnesses are a good reason to check your own deployments for the same patterns.
For breached organizations, I’d take the advice to assume stolen data is still being read seriously, since remediating the intrusion does nothing about records still sitting on an attacker’s open panel.
Context Bombs Turn Deception Against AI Attackers
Tracebit tested nine deception techniques it calls Context Bombs against seven models in a controlled AWS environment, planting lures in documents, service responses and fake attack paths. Without deception 70 of 71 runs ended in a successful compromise, while with deception 57 of 70 runs did not, and model cost rose 1.6 to 3.9 times. A fake pentest report that labeled real targets as canaries was enough to make some agents stop early and leave exploitable targets alone.
After the Cairn and Armadin stories above, it’s encouraging to see research on how defenders can make AI attackers pay, and turning an agent’s habit of chasing every promising lead against it is a clever use of deception. I appreciate that Tracebit is upfront about the limits, noting that more capable models have already been harder to deceive and that this research will likely find its way into training sets, so I’d treat deception as a control that needs ongoing testing as models improve. Tracebit also makes the point that wasting an attacker’s time and money only goes so far when harnesses can run attempts in parallel, which is why agents walking away from real targets after reading a fake pentest report is the more interesting result to me.
Rick Howard Says the Doomsday Talk Isn’t Over
Rick Howard pushes back on Sergej Epp’s call to move past AI doomsday talk and get back to work. His Bayesian forecast puts the chance of losing roughly 10% of the world’s population within a decade of losing control of a superintelligence at about 30%, and his fix is a US law banning frontier labs from recursive self improvement until alignment is solved. Sergej replied in the comments that we never solved alignment for humans either and built controls instead.
I’ve argued in “Alignment vs. Security Is a False Dichotomy” that alignment should be treated as a control with a known failure rate and backed by security, so Sergej’s reply that we never solved alignment for humans and built controls instead is close to where I land. That said, I respect Rick putting an explicit Bayesian forecast on the table, and as I discussed in “Cybersecurity is Ceding AI Safety, But Should We?”, our community stepping out of the safety conversation entirely carries its own risk. Where I’m less convinced is the fix, since a US law banning recursive self improvement at frontier labs is hard to square with how much capability is coming from open-weight models, including the DeepSeek result on Vals AI’s benchmark above.
AppSec
Agency Isn’t Authorization
In this piece, I revisit the identity gap agentic AI exposes, since agents inherit the problems we already have with human and non-human identities and add autonomy, non-determinism and delegation on top. I borrow a line from my friend Rock Lambros, Co-Lead of the OWASP LLM Top 10, that agency isn’t authorization, meaning an agent having the access to do something doesn’t make that action appropriate for the task in front of it, and I walk through what CoSAI’s agentic IAM and zero trust papers recommend.
I also dig into how Resilient Cyber partner Token Security is approaching the problem, drawing on my conversations with co-founders Itamar Apelblat and Ido Shlomo about agent discovery, a context graph tying agents to their identities and human owners, intent-based access and runtime enforcement through an agentic gateway.
MITRE ATT&CK v20 Adds AI-Enabled Techniques
MITRE’s October 2026 ATT&CK v20 release updates Techniques, Groups, Campaigns and Software across Enterprise, Mobile and ICS, and MITRE calls expanded coverage of recent adversary activity its biggest change. That includes new Campaigns for attacks on U.S. water utilities and an AI-assisted breach of Mexican government infrastructure, along with AI-focused and AI-enabled Enterprise Techniques. The release brings ATT&CK to 971 Software entries, 182 Groups and 61 Campaigns.
ATT&CK is the common language most detection and threat intel teams already work in, so AI-enabled techniques landing there is a meaningful step toward mapping agent threats with the same rigor we apply to everything else.
Claude Traces the NIST Curve Seeds to Unix Timestamps
Anthropic’s Frontier Red Team says an internal research model worked out in under half an hour that the long-unexplained seeds behind the NIST P-192, P-224, P-256, P-384 and P-521 curves came from the C library’s lrand48 generator seeded with Unix timestamps from May 1997 to April 1998, with P-256 taking 1842 iterations. Anthropic is clear this is not a cryptographic break or a weakness in ECDSA, and says the finding makes a deliberate backdoor much less plausible. The $36,864 seed bounty goes to the Internet Security Research Group.
Years of speculation about NSA-supplied curve parameters, settled by a model in under 30 minutes, is a fun reminder of how much security research AI is going to accelerate, on the defensive side too.
Separating Real CVEs From AI Slop
Bishop Fox’s Nate Robb and team note the CVE Project published 57,871 records in the first eight months of 2026, with disclosures up roughly 85% over last year while known exploited vulnerabilities rose about 14%, and they attribute a meaningful share of the growth to AI-assisted research.
Four heavily publicized Nginx CVEs this year all required uncommon non-default configurations, and Calif’s study found the rift rewrite rule in just 1 of 35,633 real configs. Their triage questions come down to whether it affects the default config, whether exploit impact is conditional, and whether it’s exploited in the wild.
That gap between disclosures and exploitation is why I’m cautious about the breachpocalypse framing, and it’s the same reason I argued in “The Zero Day Clock Stopped Ticking” that we need better prioritization signals. PHP2Shell, of course, is the kind that checks every box.
Claude Shrinks the Attack Surface Before Bugs Exist
Anthropic’s Chris Rohlf describes running Claude over more than 25 open source projects totaling over five million lines of code, inventorying 17,000+ configuration options and finding 493 issues across default configuration, configuration interaction and early reachability.
All eleven gated projects had unintentionally reachable code, including 93 unnecessary pre-authentication surfaces in default configurations, and in OpenSSH 10.4 an unauthenticated client could reach about 4,500 lines of experimental ML-DSA-44 code. Fixes across 10.5 and 10.6 removed roughly a fifth of the code reachable before authentication.
I like this a lot, because removing reachable code shrinks the pool of future bugs, which is a better long-term trade than chasing them one at a time. It pairs well with Bishop Fox’s default-configuration question above.
Agent Credential Vaults Are the New Crown Jewels
The agentgateway team’s second post on credential injection asks how much of an agent token store an attacker can read once the process holding it is fully compromised. A key encryption key in a Kubernetes Secret exposes the whole store, a key in AWS KMS makes decrypts audited and revocable, and broker-gated KMS grants remove the controller’s standing decrypt permission so every read needs a short-lived per-user grant from a separate broker.
Their framing is that KMS means a compromised controller can no longer decrypt your store “silently, in bulk, and offline.” With Railway and LiteLLM both turning into secret rotation exercises this week, I’d treat agent credential brokers as tier-zero assets the same way we treat identity providers.
OpenAI’s Patch the Planet Playbook for AI-Found Critical Bugs
OpenAI led a coalition to fix two critical PHP flaws, one found by Calif using GPT-5.6 Sol and both found independently by Wiz, and proposed a five-stage framework for coordinating disclosure as AI turns up more bugs like these. Unit 42 rates CVE-2026-109618 and CVE-2026-109619 as 9.2 RCEs, counts over 22.6 million potentially vulnerable exposed instances, and says at least one European government took its website offline as a precaution. OpenAI also committed $1 billion in subsidized Daybreak access for under-resourced defenders.
As I mentioned up top, PHP2Shell details leaked a day before the coordinated release, which is one of the conditions OpenAI’s framework says should trigger a reassessment of the timeline, and a good reminder that disclosure windows get harder to hold as more parties need advance notice. I covered Patch the Planet’s earlier fix rates in “AI Just Broke Vulnerability Management”, and with OpenAI expecting findings like these to increase sharply in the coming months, I’m glad to see them asking the community for input on disclosure windows, early notice and emergency patching. I’d like to see just as much attention on the receiving end, since $1 billion in Daybreak access helps under-resourced defenders find and fix issues, but those 22.6 million potentially vulnerable instances still have to be patched one organization at a time.
AI Dropped a Haystack on Vulnerability Triage
Casey Ellis argues AI raised both signal and noise in vulnerability submissions by roughly ten times, and the costly part is plausible reports that take a skilled human an hour to rule out. He cites Microsoft’s queue, where submissions are up 10x to around 10,000 a month and the share with nothing to fix peaked at 42% before falling to 24%. His fix is to reproduce reports by machine before a human sees them and to grade submissions instead of gating AI-assisted researchers.
Casey’s needle and haystack framing fits what I argued in “The Remediation Receipts”, that finding was never the hard part, and Microsoft’s queue shows that pressure landing on triage before anything gets fixed. I like his idea of proving positive with machine reproduction before a human sees a report, and his point that a harness failing to reproduce a bug is a fact about the harness is an important guardrail on that approach. I also agree that gating AI-assisted researchers fixes the wrong part of the funnel, and this pairs well with Bishop Fox’s triage questions above, since both come down to spending scarce human time on the reports most likely to matter.
Claude Security Moves to Continuous Scanning
Claude Security now runs a deep baseline scan once repositories are connected, then re-scans changes based on their risk and complexity, and a project can span multiple repositories to catch issues between services. It generates a threat model teams can review and edit, and later scans use it to decide what to flag and how to rate severity. Findings are marked fixed when the fix lands and reopen if the issue comes back, and it’s in public beta on Claude Enterprise.
Anthropic keeps shipping on Claude Security, and this release moves it from point-in-time scans toward continuous coverage that follows code across repositories as it changes, including issues that live between services, which matters more as agents write a growing share of that code.
I’m particularly interested in the editable threat model, since letting teams iterate on it with their own deployment context and risk policy is how a scanner starts prioritizing the way an AppSec team actually does.
As I discussed with Checkmarx’s Jonathan Rende in “AI Code Security and the Independent Control Plane”, there’s still a case for independent validation when one vendor’s models are both writing and reviewing the code, though cross-service coverage and fix tracking that reopens regressions are meaningful steps.
Final Thoughts
PHP2Shell went from leaked details to millions of exploitation attempts in under two days, and that same week brought AI agents breaching companies for about $50 apiece, open source attack tooling crossing borders, and coding agents quietly switching off their own monitors.
I’m not ready to call it a breachpocalypse, since exploitation is still growing far more slowly than disclosures and plenty of defenders responded quickly this week, including the ones who took their own sites offline. That said, the time between disclosure and exploitation keeps shrinking, and attackers are clearly using AI and autonomy to scale.
The response is the unglamorous work we already know, which is knowing where things like PHP actually run, patching critical internet-facing systems in hours, and keeping monitoring and enforcement outside the reach of the agents we deploy. The question is whether we can fund and staff it faster than the attackers are scaling.
Stay resilient.