Tech Brief

Friday, October 23, 2026

The day the embargo broke: PHP's two critical RCEs, a Node Brotli RCE and a CA with single-byte keys landed in the same 48 hours, and the supply chain behind your apps is the part that hurts.

Most of what you read yesterday was patch-or-else news. PHP shipped fixes for two unauthenticated RCEs on Wednesday after the details leaked early, Node followed with its own Brotli RCE, and a certificate authority turned out to have signed with keys small enough to guess in under a second. Add a hosting platform that lost customer environment variables and a Shopify app with a checkout redirect, and the common thread is that you inherit other people's patch cadence.

Action today: confirm your PHP and Node versions, rebuild container images so the new CA bundle lands, and rotate anything stored in Railway. If you run Shopify apps, check which ones you installed and who hosts them.

The big story

PHP2Shell, two RCEs and an embargo that did not hold

3 min read

What happened. On October 21 at 14:00 UTC the PHP team released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two unauthenticated remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 (PHP advisory). The team had posted advance notice on October 20. Wiz found the bugs on August 19 and reported them August 24; PHP acknowledged on September 21 (Astra timeline).

The mechanism. The first bug is out-of-memory handling: PHP can be interrupted while request data is half-initialised, and cleanup then treats the invalid data as valid. The second is stale global state: request-owned internal state survives after its memory is freed, and a later request on the same worker can use it before initialisation resets it. Everything serving web requests is affected (FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed). PHP rates mod_php highest, because an unauthenticated request can trigger it before any application code runs. Wiz demonstrated RCE against WordPress, Drupal and Joomla, and says frontier models helped chain the bugs.

The leak. The embargo ended early. A user posted on Hacker News before knowing an embargo existed and later apologised (Tell HN, 344 points, 144 comments). Commenters mostly say the breach happened earlier in the chain and blame distributors; the names Chainguard and calif.io come up, but I could not verify that from a primary source. watchTowr publicly confirmed the leaked bugs were real before the patch was out. The tptacek comment calls it a five-alarm fire and says non-public PoCs work, while others say the public PoCs mostly fail and depend on conditions like disabled ASLR. CISA and the FBI both issued advisories (seen on X).

Who is affected, and what is unknown. A commenter in r/ExperiencedDevs (135 points, 58 comments) says Cloudflare's WAF mitigated millions of attempts and that the public php2shell script owns a stock PHP 8.2 plus Laravel install in 35 seconds. Both claims are unverified. Confirmed in-the-wild compromise counts are not public. PHP 8.1 and older get no official fix; PHP published minimal backports for 7.4, 8.0 and 8.1, and some vendors backport silently, so version strings can mislead.

Assessment. HIGH confidence the bugs are real and patchable now. LOW confidence on how many servers were actually hit. The best reaction in the thread came from an engineer who patched hundreds of containers by 8pm because the team upgrades PHP majors yearly, and the business had questioned that habit for years. Expect that to be the argument that finally works for you too.

AI / LLM

Anthropic shows Claude writing machine-checked proofs for 123 libraries

1 min read

Anthropic says Claude produced formal proofs for 239 entry points across 123 OSS-Fuzz libraries, proving no crash for any input under 64 MB, checked by the Rocq proof checker (Anthropic; HN, 42 points, 12 comments). The proofs total about 180 million lines of Rocq and found hundreds of bugs, including a libexpat CVE rediscovery. The caveats matter more than the headline: the proofs cover static RISC-V musl binaries, not the dynamic glibc x86 or ARM builds you ship, and they can run to hundreds of millions of tokens each. This is vendor-reported. Verdict: the interesting part is turning existing fuzz harnesses into specs, which you can copy without the proof budget.

NVIDIA OpenShell is a credible agent sandbox, with telemetry on by default

1 min read

OpenShell is an Apache-2.0 runtime that isolates each agent with kernel controls, checks every outbound connection against policy and injects credentials only on requests to approved endpoints, so the agent never holds real keys (repo; HN, 283 points, 144 comments; r/LocalLLaMA, 83 points). Policy changes get a formal-verification check before human review. It is at 0.1.x and collects anonymous telemetry unless you disable it. Verdict: after yesterday's markdown-instruction attacks (see Security), credential-isolated sandboxes are no longer optional for coding agents. Try it on a throwaway repo first.

Claude product news: Duet preview and Agent Skills move to a foundation

1 min read

Anthropic opened a Claude Duet research preview, a proactive agent app, limited to US Pro and Max users on a waitlist (r/ClaudeAI, 103 points, 37 comments). Separately, ClaudeDevs said it is donating the Agent Skills standard to the Agentic AI Foundation and counts 70+ platforms integrated since December 2025 (seen on X). Usage limits are the loud complaint: threads on Pro vs Max pricing (385 points, 113 comments) and disappearing resets (98 points, 130 comments) dominate, and X trends an Anthropic test of lower Max limits (headline only, not read). Verdict: skills as a neutral standard lowers your lock-in risk; budget for tighter limits.

Open-weights chatter: rumours and one real release

1 min read

r/LocalLLaMA's top post is Kitten-TTS 2, a 1.58-bit CPU-only TTS with voice cloning (700 points, 144 comments). The second is an Arena sighting of Qwen4 and Kimi3.1 (620 points, 228 comments), which is a rumour until weights or a vendor post appear. DeepSeek and MiniMax reportedly cleared China's export rules for overseas open-source releases (152 points). All three rest on the discussion threads only. Skip the rumour, test the TTS if you need on-device voice.

Programming

Node.js Brotli RCE: patch the same day

1 min read

CVE-2026-111497 is an out-of-bounds write in Node's Brotli decoder, rated High, affecting 26.x, 24.x and 22.x; fixed in v22.23.4, v24.22.1 and v26.12.1 (Node advisory; r/netsec, 38 points). OpenAI Codex Security reported it. Imperva says app.use(express.json()) is enough to expose a vulnerable server through one Brotli request (seen on X; I did not open the Imperva post). The same release has three High TLS and DNS hostname-validation CVEs, including bypasses with fullwidth digits. End-of-life Node lines get no patch. Verdict: any Express app on 22 to 26 is a priority today.

DuckDB 2.0 LTS: read the breaking changes before you bump

1 min read

DuckDB 2.0 "Cinnamon Teal" ships async I/O for S3 reads, a shredded VARIANT type, triggers, a PEG parser as default and a CLI mode that detects coding agents (release post; Lobsters, 24 points). Two traps: databases written by 2.0 cannot be read by pre-2.0 versions, and single-arrow lambdas (x -> x + 1) are off by default and removed in 2.1. Support runs until at least October 2027. Verdict: upgrade a shadow copy first.

Zig's opinion piece and Arc's shutdown

1 min read

daily.dev's "must-read" this morning is an opinion piece arguing Zig's management is driving users away: still 0.x after a decade, 0.17.0 still breaking, a ban on AI-assisted contributions, and a move to Codeberg (read via the daily.dev summary, not the original). Zig tooling still shipped zls 0.17.0 on Lobsters (70 points). Also, the Arc browser shuts down December 22 (HN, 224 points, 203 comments). Verdict: do not bet production tooling on a pre-1.0 language without a pinned toolchain; export your Arc spaces now.

Security

eMudhra's CA keys were single-byte numbers

1 min read

Eight eMudhra intermediate CA keys were tiny integers such as 4, 56 and 115, so an attacker could recover them in at most 255 steps; Scott Helme recovered all 16 affected keys in under a second (write-up; Lobsters, 75 points; HN: eMudhra exits the global TLS business, 912 points, 620 comments). Browsers blocked the intermediates within hours on October 17, and Certificate Transparency would expose forgeries. The danger is non-browser clients: Helme showed a forged api.stripe.com certificate accepted by curl, Python and Node on Linux and macOS. The keys were effectively public from April 2025. eMudhra blamed a script bug plus a human error, per the Mozilla incident ticket as relayed in the write-up. Verdict: update ca-certificates, certifi and base images; the Node release above also carries the removal.

Railway lost customer environment variables

1 min read

Railway detected unusual activity on systems storing customer environment variables, paused deployments, and says some variables were decrypted by a third party (Railway disclosure; Lobsters, 25 points). It calls this part of a series of attacks on platform companies aimed at AI inference providers and states no root cause. Railway recommends rotating all environment variables and registry credentials for every user. Verdict: do it today, in that order: LLM provider keys, database credentials, registry tokens, then check provider logs.

Markdown instructions as an attack vector, and a GitLab 10.0

1 min read

A netsec post (161 points, 27 comments) reports attackers dropping agent instruction files into the Downloads folder from web pages, so a coding agent picks them up as trusted context. I read only the thread title and link, so treat the details as unverified. Separately, a GitLab flaw, CVE-2026-110264, CVSS 10.0, allows unauthenticated RCE on self-managed servers across 12 years of releases (r/cybersecurity, 572 points; the Hacker News article returned HTTP 403, so version details are missing). Verdict: if you self-host GitLab, check the vendor advisory now.

Linux kernel bugs and the "Black October" mood

1 min read

Several critical Linux kernel vulnerabilities were posted by accident to the public kernel mailing list (r/cybersecurity, 253 points; headline only). A viral r/OpenAI thread (1,367 points, 348 comments) calls the week "Black October"; the top replies call it sensational, and one asks whether anyone has compared against other Octobers. My read: volume is up, and the common cause is AI-assisted discovery outrunning human patching ("AI-speed discovery, human-speed remediation" was the top-voted joke).

Shopify and e-commerce

A pre-order app redirected checkout to a lookalike domain

1 min read

A developer reports that a client's store began sending checkout traffic to shopcheck.top after installing the Amai Pre-Order Manager + Notify app (r/shopify, 8 points, 7 comments). This is a single report that I could not corroborate. A commenter who runs a competing pre-order app says there have been multiple reports across categories, also unverified. Another commenter's advice is right: uninstall the app, since disabling the theme embed leaves its API access intact. Verdict: if Amai is installed, remove it and audit checkout scripts.

"Is Shopify affected by PHP?" Wrong question

1 min read

Shopify's storefront is not the exposure. The useful answer in the thread (5 points, 33 comments) is that your app vendors' servers are: a compromised app can leak long-lived access tokens, and reinstalling an app rotates its token. One merchant reported three apps confirmed on PHP, two patched (Easy Order Manager, Instafeed) and one still fixing (Up Promote); Rebuy emailed customers about a patch. Verdict: ask every app vendor whether they run PHP and have patched, and uninstall dormant apps.

Shopify ships an app security check and Claude hooks

1 min read

Shopify Developers announced app security check, a tool that finds common vulnerability patterns in apps, run through its AI Toolkit (seen on X, October 15). Shopify also said its store tooling connects to the new Claude Duet from day one, and a Shopify engineer showed AI agents building and testing mobile apps via a browser-accessible simulator (HN, 3 points). Verdict: run the security check on any app you maintain this week; it costs nothing after this week's events.

SaaS and indie business

What software is worth when code is cheap

1 min read

The most active SaaS thread asks what happens to software's value as it gets easier to build (r/SaaS, 90 points, 128 comments). The top reply says many people can cook but few can run a restaurant. Others add that buyers pay for continuity and accountability, and that cheap code means more demand for custom software, not less. The pessimists argue it becomes a race to token cost. My read: the durable position is running the workflow, with security questionnaires and integration breakage, not owning unique code.

"Nobody is thinking anymore"

1 min read

The top r/webdev post (327 points, 82 comments) argues developers outsource judgment to AI. Replies split: one side asks where senior engineers come from without junior work to do, the other says teams were ordered into AI workflows while headcount shrank. The sharpest reply says no dev got stupider; the job changed. Hiring managers in the thread say candidates fail simple technical rounds.

Quick hits

  • Quad9 will stop serving France on November 24 after a court-ordered blocking case; its post also says the blocking "concludes on November 14", an unexplained discrepancy (Quad9).
  • musl libc CVE-2026-107891: integer overflows in regcomp that can lead to heap out-of-bounds writes (oss-security).
  • QPACK amplification attacks against HTTP/3 servers, "Header Accordions" (FoxIO).
  • Capcom confirms a breach affecting more than 11.7 million Capcom ID accounts (r/cybersecurity, 273 points).
  • Axios reports major US banks detecting unvetted AI agents inside customer accounts (r/cybersecurity, 80 points).
  • Unverified: X and a Reddit post claim LiteLLM 1.107.0 on PyPI shipped a backdoor, and that a fresh dspy install pulled it (r/LLMDevs). A web search found only the March 2026 incident (1.82.7 and 1.82.8) and nothing on 1.107.0. Check your lockfiles anyway.
  • Firefox Local Mode in devtools, 140 points on Lobsters (docs).
  • Switch 2 jailbreak write-up, 701 points on HN (blog).
  • Google Cloud launches Agent Compute Engine, a microVM per AI agent (daily.dev headline, not opened).
  • Qdrant published a critical advisory for unauthenticated cluster access (GHSA; title only).

Worth a long read

  • WorldTUI: I trained a 360M model to pretend to be a terminal (HN, 500 points). A small world model that imitates a shell is a clean way to see what next-token prediction can and cannot hold as state. I have not read it in full.
  • Passkeys Attestation Trap (Lobsters, 29 points, 75 comments). The comment count suggests a real argument about who gets to decide which authenticators are allowed. Read it before you gate a login flow on attestation.

By the numbers

  • 9.2CVSS v4.0 score for both PHP RCEs (PHP advisory).
  • 17 monthshow long the eMudhra keys were effectively public, April 2025 to October 2026 (Helme).
  • 180 millionlines of Rocq in Anthropic's verification run, across 123 libraries (Anthropic).
  • 16eMudhra CA keys recovered in under a second, from at most 255 guesses each (Helme).
  • 11.7 millionCapcom ID accounts in the confirmed breach (r/cybersecurity).

Do this today

Sources and coverage (small print)
  • Reddit (MCP, get_top_posts, day, limit 15): 13 of 14 subreddits returned posts; r/ShopifyDevs returned "No posts found". Comment threads opened for 6 posts: r/ExperiencedDevs PHP, r/OpenAI Black October, r/webdev, r/shopify PHP, r/SaaS, r/shopify Amai. r/ClaudeAI, r/LocalLLaMA, r/LLMDevs and r/MachineLearning items rest on titles and scores only.
  • Hacker News: top 40 stories read via Firebase. The first Algolia attempts (shopify, llm, vulnerability) failed with JSON parse errors (empty response, retried once); a retry with the > encoded as %3E succeeded and returned 12 hits per query.
  • Lobsters: hottest.json, top 25.
  • daily.dev: the For You feed loaded. The ai, webdev and security tag pages returned stale May 2024 content, so I did not use them.
  • X (ego-browser, logged in, read-only): home timeline and searches for Shopify, LLM, AI agents, CVE, zero-day, SaaS all loaded. This is better than the previous run.
  • Primary sources opened: PHP advisory, Node advisory, Railway, Helme (eMudhra), Quad9, Anthropic, OpenShell, DuckDB, Astra. HTTP 403 on CNBC and The Hacker News; redd.it blocked in WebFetch.
  • Discussion or headline only (no primary source read): GitLab CVE-2026-110264 details, Linux kernel LKML leak, Markdown-instructions attack, Amai app compromise, Capcom, Axios bank agents, Imperva Node2Shell, LiteLLM 1.107.0, "Faster than Rust" debunk, the Zig piece, Qwen4/Kimi3.1, Kitten-TTS 2, Claude Duet, Agent Skills donation, usage-limit changes, the eMudhra exit press release.