PHP2Shell: AI-built exploits for old PHP engine flaws force emergency patches
PHP ships 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two remote code execution flaws in the engine that Calif and Wiz turned into working exploits, with OpenAI reporting the same root cause. LiteLLM 1.107.0 on PyPI and Docker shipped a credential stealer; OpenAI's GPT-6 models arrive on Google Cloud in private preview; Recursive releases Flint, an open-weight coding model for laptops.
- PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two flaws (rated up to CVSS 9.2) that let an unauthenticated attacker run code on servers running PHP itself; update now, since only 8.2 and newer get fixes.
- Calif, OpenAI and Wiz reported the flaws (Wiz used Gemini 4 Argon and GPT-5.6 Sol), and the CVE IDs leaked, so PHP shipped a day early; Cloudflare’s WAF blocks attacks by default on plans with the WAF on, including Free.
- LiteLLM 1.107.0 on PyPI and its
latestDocker images shipped a credential stealer that runs on every Python start; if you installed it, rotate every key on that machine. - OpenAI’s GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna are in private preview in Google Cloud’s model garden, billed on the Google Cloud invoice; no prices yet.
- Recursive released Flint, an Apache 2.0 coding model with 40B parameters (2.5B active) that Recursive says runs at over 125 tokens a second on an M4 Pro MacBook Pro at short contexts.
- DuckDB 2.0 LTS adds an agent mode for coding agents and asynchronous I/O for faster S3 queries.
Patch PHP today: the bug is in the engine, not your app
The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October to fix CVE-2026-109618 and CVE-2026-109619, rated up to CVSS 9.2. Both come from how PHP handles fatal and out-of-memory errors: a request can leave corrupted state behind for the next request on the same worker. For the first, on Apache with mod_php, the PHP Foundation says unauthenticated code execution works with default settings before any application code runs. Wiz, which named the bugs PHP2Shell, says every version back to 5.4 is affected by at least one, showed pre-authentication RCE on the latest WordPress, Drupal and Joomla images, and could read passwords and API keys from worker memory.
Fixes ship only for 8.2 and newer; 8.1 and older are past end of life, and 8.2 loses security support on 31 December. Cloudflare has blocked exploits by default since 03:02 UTC on all plans with the WAF on, including Free, using a new check that also inspects the origin’s response. Paid plans should confirm the Managed Ruleset is in block mode.
Why it matters
Update PHP everywhere today, including containers and base images. Until then, Wiz suggests watching for multipart requests followed by memory-limit errors or bursts of HTTP 500s, oversized PHPSESSID cookies and unexplained worker restarts.
The AI part cuts both ways
The PHP Foundation saw the out-of-memory problem in 2024 but couldn’t settle on a fix; it calls that delay “a structural failure”. On 11 August, Calif, auditing PHP under OpenAI’s Patch the Planet program, reported a working RCE, and OpenAI independently reported the same root cause. Wiz found more with Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas, and says the models turned a longstanding flaw into working exploits. The CVE IDs leaked on 20 October, so PHP shipped a day early. Expect more old bugs to become exploitable this way.
LiteLLM’s latest release stole your keys
LiteLLM 1.107.0, the Python LLM gateway, was uploaded to PyPI at 11:39 UTC on 21 October with a credential stealer, and the v1.107.0, latest, main-latest and main-stable Docker images carried it too until about 13:53 UTC, according to Wiz. SafeDep found that the package drops cook.pth, cook.py and sitecustomize.py into site-packages, so it runs whenever Python starts on that machine, even if nothing imports litellm. It takes SSH keys, cloud and CI credentials, AI provider keys and browser passwords, and reads the provider keys stored in a LiteLLM proxy’s database. On Linux and macOS a background loop was built to fetch and run more code every hour; its GitHub dead drop was taken down at about 13:40 UTC, but hosts that ran it earlier may have received more code. PyPI has removed the release; 1.106.2 is clean.
Why it matters
If any machine, CI runner or proxy container installed 1.107.0 or pulled latest today, treat it as compromised: rebuild it and rotate every credential it could reach, starting with the LLM keys in the proxy.
Stolen GitHub CLI tokens, again
LiteLLM’s maintainer BerriAI says, via Wiz, that the attacker used three engineers’ GitHub accounts, apparently through stolen GitHub CLI OAuth tokens: one account started the release, another approved it. By coincidence, GitHub CLI 2.103.0 added expiring, auto-refreshing tokens the same day (gh auth login --expiring), so a leaked access token stops working within hours. The refresh token is stored alongside it, so malware on the machine can still renew it. It’s an opt-in public preview; turn it on for accounts that can publish releases anyway.
OpenAI’s models land on Google Cloud
Google Cloud added GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna to its model garden on 21 October, in private preview for selected enterprise customers. Usage is sold through Google Cloud Marketplace, so it appears on the Google Cloud bill, draws down existing commitments and counts toward Flexible Savings Plans. Developers can point Codex CLI and Codex Desktop at Google’s Gemini platform for inference. Google says prompts aren’t used for training and the models run on dedicated Google Cloud infrastructure; zero data retention and confidential computing are “coming soon”, as are Gemini for business and Antigravity.
Why it matters
Teams with Google Cloud commitments can spend them on GPT-6 instead of signing a separate OpenAI contract. Google hasn’t published per-token prices.
OpenAI is now on every big cloud
Microsoft already resells OpenAI models on Azure, and GPT-6.1 Sol went GA on Amazon Bedrock in September, so this is about distribution, not a better model. Google says it is now the only hyperscaler offering all three leading closed models. Expect model choice to depend less on which cloud you use and more on price and limits.
Recursive’s Flint brings a 2.5B-active coding model to laptops
Recursive released Flint on 21 October, an open-weight coding model with 39.8 billion parameters, about 2.5 billion active per token, under Apache 2.0 on Hugging Face. Recursive reports 54.9% on Terminal-Bench 2.1 and 74.2% on SWE-bench Verified. With its own optimized inference engine, it says Flint runs at over 125 tokens a second on an M4 Pro MacBook Pro and over 150 on a 64 GB RTX Spark, at short contexts. The main repo is the 80 GB BF16 checkpoint for a single B300 or H200; quantized builds for laptops are separate, and Recursive says Flint works with llama.cpp, Ollama, LM Studio, Unsloth, vLLM and SGLang. Recursive says its automated research system, the Eureka Machine, helped build nearly every part of the stack in under four months.
Why it matters
A model this size can handle routine coding offline with no API bill and no code leaving the laptop. Recursive itself says it needs more guidance than the big closed models.
Fast, but not ahead on score
On vendor numbers, Flint’s 74.2% sits between Alibaba’s Qwen3.6-35B-A3B (73.4%) and Meta’s Muse Glimmer 30B (76.0%) on our models table. Its case is speed from fewer active parameters. Independent scores will decide whether it becomes the default local model.
Quick hits
- DuckDB 2.0.0 LTS adds an agent mode that cut the output agents read by 59% in its TPC-H tests, a polished Quack client-server protocol (introduced in 1.5.3), asynchronous I/O and a fully integrated VARIANT type; supported until at least October 2027.
- Cohere Rerank 5 (
rerank-v5.0-pro,rerank-v5.0-fast) adds calibrated scores and can optionally return scored passages inside each document, so you can send less text to your LLM without re-indexing. - NVIDIA OpenShell Reference Architecture packages its agent sandbox runtime with Vera Rubin, Vera CPUs and BlueField-4 DPUs running NVIDIA Sentry for in-hardware policy enforcement, announced at GTC Berlin.
- Google Cloud A5X instances on Vera Rubin NVL72 reach general availability next month, with Europe to follow; Google plans up to 960,000 Rubin GPUs.
- Databricks AI Runtime is GA: serverless GPUs for training inside Databricks, governed by Unity Catalog.