Daily
- Stolen AI API keys: OpenCode, LiteLLM and Railway breached in a weekIn one week OpenCode, LiteLLM and Railway were breached by attackers after AI provider keys, two of them explicitly to fund distillation. Also, AI-found bugs like PHP2Shell outran their embargoes, the labs admitted their own agent monitors leak, Kimi K3.1 Pro came within a few points of Opus at half the price as Washington banned DeepSeek, and the chip and API layers went neutral.Saturday edition
- PHP2Shell tops a day of emergency patches and stolen keysPHP ships 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two engine RCE flaws that Calif and Wiz turned into working exploits, and AWS saw attacks four days before disclosure. LiteLLM 1.107.0 shipped a credential stealer, Railway says environment variables may have been exposed, and GitLab patches a CVSS 10 flaw. Anthropic opens a waitlist for Claude Duet, a proactive agent app; OpenAI's GPT-6 models arrive on Google Cloud.Daily
