PHP ships early fix for php2shell, a 14-year-old RCE found with AI

Brockman says the bug let attackers run code on nearly all deployed PHP apps, and Wiz traces it back to PHP 5.4. Models found it in August, yet the fix took two months of manual coordination and still leaked a day early, a pace he says will not scale. Read: Brockman says the bug let attackers run code on nearly all deployed PHP apps, and Wiz traces it back to PHP 5.4. Models found it in August, yet the fix took two months of manual coordination and still leaked a day early, a pace he says will not scale. Read: The exposed variables include API keys, and Railway links the attack to a campaign against platform companies aimed at AI inference providers. All builds are d while it investigates, so customers face both possible key exposure and blocked deploys. Read: The release drops three files into site-packages that run a stealer and a remote-code backdoor on every Python start, not only when LiteLLM is imported. LiteLLM is a common gateway for model API keys, so an infected host exposes the credentials it was built to route. Read: Duet handles inbox, calendar and follow-ups while the user is away and stops for approval on key actions. After two weeks of testing, Dan Shipper says it can see his local Claude sessions but not direct them, and voice is transcription only. Read: Agent traffic and data center power limits forced GitHub's move to Azure, and a 25ms cross-region trip capped the busiest repos. Locking per reference, not per repository, lets agents pushing to separate branches stop queueing behind each other. Read: Claude Code on the same Opus 5.5 lead scores 66.0 at $13.04 and 65 minutes per task. Fusion hands work to a cheaper GPT-6 Luna sidekick, so its per-task cost falls 31% and its run time falls 10 minutes while the score rises. Read: The default cache expires after 30 minutes, so an agent idle between requests paid full input price to reload its instructions and tools. Twelve-hour retention keeps that prefix at the cached-input rate across a working day, for an added caching charge.