Thursday, 22 October 2026
PHP2Shell exploits take down government sites worldwide as AI models crack a decade-old flaw; Anthropic launches Claude Duet; LiteLLM 1.107.0 supply chain attack targets AI credentials
Today's Lead
EngineeringKrebs on Security
Widespread PHP Flaw May Cause Many Site Outages Today
Krebs on Security reports two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that let attackers seize full control of affected servers. Together they affect nearly 70 percent of websites, including those running WordPress, Drupal, Magento, and Joomla. All PHP versions from 5.4 onward are vulnerable. Cloudflare detected active exploitation and deployed Web Application Firewall (WAF) rules before official disclosure. Government websites in Europe went offline after the vulnerabilities became public. OpenAI and the security firm Wiz independently discovered the flaws using AI models over a coordinated two-month response. Fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Engineering
Trail of Bits
Your AI Agent Fixed the Bug, but What Else Did It Change?
Trail of Bits released two open-source plugins for AI coding agents. The patching-bugs plugin reproduces a reported bug, writes a fix, and tests the fix. The regression-hunt plugin checks whether a change breaks behavior that worked before. Trail of Bits found 21 regressions in over 130 merged patches. The regression-hunt plugin produced 25 percent fewer false positives than a baseline Codex agent.
GitHub Blog
The Bridge to Agent-Scale Git Infrastructure
GitHub moved a copy of nearly all its repositories to Azure. The busiest repositories still face about 25 ms of latency between regions. The current quorum waits for every healthy replica, so the slowest replica sets the write latency. The new design scopes each quorum to one reference, such as a branch, so writes to different references run in parallel. Internal tests show 3 to 4 times higher write throughput. Repository data moves to Azure Blob Storage, and read replicas scale out on demand.
Anthropic
Claude Duet
Claude Duet is a proactive AI agent in research preview. You send it tasks by message. It works on its own cloud computer and uses the apps you connect. It sends a morning brief and drafts replies for your approval. It asks for approval before it sends messages or makes payments. It is available on a waitlist for US Pro and Max subscribers.
SafeDep
Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor
Attackers published a malicious LiteLLM 1.107.0 release to the Python Package Index (PyPI). The attackers used stolen developer credentials to bypass release controls. The package installs a credential stealer and a backdoor. The stealer runs at every Python startup, even when LiteLLM is not imported. It sends Secure Shell (SSH) keys, cloud credentials, and build secrets to a remote server. Users must remove version 1.107.0, check for the file cook.pth, and rotate exposed credentials.
Humanities
Aeon
Other People
Elizabeth Oldfield lives in a shared house in south London with unrelated adults. She argues that modern individualism causes loneliness, distrust, and poor mental health. Close community is a practical answer. Members share space, money, and work, and they learn reciprocity and mutual care. Other people see our faults, so community shows our self-deceptions. The author says psychology, philosophy, and monastic tradition support this view. She admits the arrangement is demanding, and community lasts only when it serves a shared ethical, ecological, or religious goal.
Aeon
Bhutan: The Last Place
A PBS Frontline documentary covers Bhutan, a small Buddhist kingdom. Bhutan had no television until 1999. Foreign broadcasts then made many people want new things. Some people copy professional wrestlers and buy branded clothing. Interviewees, including monks and children, know these changes harm their culture. They also know that the changes are hard to stop.