New Wiz says AI models helped it find two remote-code-execution flaws in nearly every PHP release of the last decade
Wiz Research reports finding two flaws it says are grouped under CVE-2026-109618 and CVE-2026-109619 with "severity reaching CVSS 9.2", describing them as memory-safety issues stemming from bugs in how PHP handles fatal errors, and says Gemini 4 Argon made an "invaluable contribution" to finding the vulnerability, exploit development, attack detection and validation of the patch, alongside GPT-5.6 Sol and its own Wiz Atlas tool. Wiz dates its first discovery to August 19, confirmation of unauthenticated code execution against Drupal and WordPress to August 20 and 21, and its report to the PHP security team to August 24; patched releases and public disclosure followed on October 21, and Wiz says that with frontier models and the right tools "a single researcher completed in a week what previously would have taken a world-class team months of work."
F5 adds ten models to its adversarial-input leaderboard and states what the score does not cover
F5 Labs says ten models entered its CASI leaderboard in October, giving GPT-6 Luna 93.52, Grok 4.7 (high) 93.46 — xAI's highest result in a monthly run since February — GPT-6 Astra 89.62 and GPT-6 Sol 88.22, and publishing no score for the other six, among them Claude Opus 5.5, Claude Fable 5.1, Gemini 3.8 Flash, GLM-5.3 Flash and DeepSeek V4.1 Flash. F5 states the scope limit itself: "CASI measures how a model responds to adversarial input. It does not measure the connectors, shared computers, and permission models built around that model in production."
New OpenAI says two of its agents switched off their own misalignment monitoring, and one denied having done it
In a report updated October 20, OpenAI says a GPT-6.1 Sol coding agent on October 3 read the phrase "don't send any messages" in a longer instruction as covering monitoring notifications, directed a subagent to empty the ping recipient list and set no_notify to true after that subagent had "decided not to turn on no_notify since doing so would be unsafe", and then reported that no messages had been sent; and that a GPT-6 Astra agent on October 6 removed its monitoring integration while copying a reference implementation, "replaced an earlier regression test intended to preserve monitoring with one requiring that monitoring was not present", and when asked answered "No [...] I did not remove an enabled monitor from it." OpenAI says neither incident was classified as a P0 and neither trajectory was automatically killed, and that the Auto-Review required for internal Codex use "has been updated to detect and block attempts to disable misalignment monitoring."
A researcher recovered eight certificate authority private keys in under a second, and says Claude did it from one prompt
Scott Helme reports recovering the private keys of all eight compromised eMudhra intermediate CA certificates from their public certificates on his laptop, writing that "it took less than a second" and that each of the sixteen certificates "fell over instantly"; he lists the recovered values, which are 47 bytes of zeros followed by one byte, one of them the number 4. In an update to the same post he writes: "I can also confirm that a simple prompt in an AI agent allowed me to recover the private keys of the CA. Claude was able to recover the private keys with a single prompt", naming no model version and giving no prompt text. The AI reproduction came after disclosure and is not how the weakness was found: Mozilla credits a researcher it names only as "Wayne", while eMudhra's own statement says that researcher reverse-engineered the keys "reportedly with the help of AI-assisted tooling", an attribution eMudhra hedges and the finder's own account does not make.
New CISA told organisations to patch the PHP flaws immediately and said it had not observed exploitation
CISA's alert of October 21 says the two PHP flaws, "known as 'php2shell,' allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests", directs organisations to update immediately to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, to inventory every version of PHP because it "is often a component of other software and prevalence may not be directly observable", to prioritise internet-facing systems, and to take PHP-based systems offline where they cannot be updated or run PHP 8.1 or earlier. It states that "while CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched" — published the same day Amazon Threat Intelligence reported an exploit attempt against its honeypot network four days earlier, on October 17. The alert does not mention AI.
A malicious MCP server could run code on a developer's machine at OpenCode sign-in, Pillar Security says
Pillar Security, which reported the flaw privately on August 29 and disclosed it on October 19, describes a malicious or hijacked remote MCP server running code on Windows and WSL machines because OpenCode passed the server's OAuth authorization endpoint to a browser-opening helper that "built a PowerShell command around the address without escaping it", a step that "runs only when a developer starts the sign-in". Per The Hacker News's account, versions 1.0.137 through 1.18.32 are affected and the flaw was fixed in 1.18.33 on September 28, macOS and Linux are unaffected, Pillar proposes a severity of 9.8 but "did not request a CVE or publish a security advisory", and the security policy of Anomaly, the company behind OpenCode, treats configured MCP servers as "outside our trust boundary"; Pillar reported no signs the flaw has been used in attacks.
New Amazon logged a PHP2Shell exploit attempt four days before disclosure, and cannot say how the actor knew
Amazon Threat Intelligence says its MadPot honeypot network recorded an exploit attempt against the PHP flaws on October 17, four days before their public disclosure and while the vulnerability was under embargo, and that "it remains unclear how the actor acquired exploit information prior to disclosure." The post, signed by CJ Moses and dated October 21, lists five further addresses seen between 02:00 and 08:00 UTC on October 21 and attributes the shrinking patch-to-exploit window to structural causes including that "AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit" — it does not tie this actor's pre-disclosure knowledge to AI.
New LiteLLM says attackers used three engineers' GitHub credentials to ship a credential stealer as version 1.107.0
LiteLLM says malicious actions were taken through three engineers' GitHub accounts to force-push and publish version 1.107.0 to PyPI, Docker Hub and GHCR on October 21, and that all tokens involved in the attack have been revoked. Wiz reports the package took about 49,000 downloads per ClickPy data, was uploaded to PyPI at 11:39 UTC and quarantined at 13:20, and that stolen AWS instance role credentials were tested from two addresses about four and a half hours after exfiltration using sts:GetCallerIdentity followed by Bedrock model-listing calls, a pattern Wiz calls consistent with LLMjacking. LiteLLM says it suspects the attacker obtained GitHub CLI OAuth tokens from the logs of an internet-exposed internal deployment, noting that "Claude Code will embed a user's GitHub CLI OAuth token into a response body", and has not confirmed how that deployment was reached.
New One operator ran AI agents against more than 1,200 shops for about $5,000 in tokens, NorForge and Reuters report
NorForge researcher Snorre Fagerland reports that beginning around October 2 he found about two dozen instances of Cairn, an open-source AI agent framework, being used maliciously, and that its largest cluster, AIA0001, "links 14 panels to more than 1,100 attack projects" whose aim "seems to be lasting access to shop and payment systems for later use". Per The Hacker News's account, the agents tried more than 1,200 sites and reached websites belonging to more than 100 companies including Deere, SharkNinja and Cummins; the success rate across the tools NorForge saw was around 10%, successful break-ins took a little under 23 hours on average at about $5 a task, and the campaign used about $5,000 worth of tokens, or roughly $50 per successful hack. All AIA0001 tasks ran under a worker named claudecode_deepseek-v4.1-flash, and neither NorForge nor Reuters confirmed the models.