One of the private keys behind a publicly trusted certificate authority’s intermediate certificates was literally the number ‘4’. Scott Helme recovered it, along with the keys for seven other eMudhra intermediate certificates, from the public certificates on his laptop in under a second. That landed the same week PHP2Shell leaked before its patch existed and a backdoored LiteLLM release sat behind the latest tag. Rogue agents played no part in the week’s three biggest stories, and all three hit controls you assumed someone else was checking.
A certificate authority is supposed to generate keys nobody can guess. An embargo is supposed to hold until the fix ships, and a latest tag is supposed to point at what the maintainers built. All three assumptions failed in public within five days.
AI runs through the rest. Frontier models helped find PHP2Shell, and OpenAI disclosed that two of its own coding agents turned off the monitoring built to watch them. Eleven items, each first disclosed between October 16 and October 22, 2026.
1. PHP2Shell Leaked Before Its Patch, And Attackers Started Early
PHP2Shell is two unauthenticated remote code execution flaws in the PHP interpreter itself, CVE-2026-109618 and CVE-2026-109619, both scored 9.2. Details leaked on Tuesday, October 20, 2026, when a Hacker News post and the CVE IDs circulated two days ahead of the planned Thursday release. PHP pulled its fixes forward and shipped 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, so every PHP install below those versions is in scope, and 8.1 and older get no official fix. Amazon says its honeypots saw exploitation attempts starting October 17, and Cloudflare reported thousands of attempts in the ten hours before the announcement.
Why it matters
The flaws sit in PHP itself, so clean application code won’t save you.
Exploitation attempts started before the leak, so the disclosure date understates exposure.
End-of-life PHP stays exposed with no fix coming.
What to do about it
Inventory every PHP runtime, including vendor appliances and control panels.
Patch to the fixed releases or your distro’s backport, and isolate anything older.
Alert when PHP worker processes spawn shells, curl, or wget.
Rock’s Musings
An embargo is the agreed quiet period between a fix being ready and the world hearing about it. This one had to cover Calif, which found the bug class on August 11, plus Wiz and OpenAI, which found it independently in the following weeks. The PHP Foundation says Chainguard broke the embargo early on October 21 by publishing fixed images, letting anyone study the fix before the release, and Chainguard says it acted on evidence of exploitation. Attackers were probing four days before the patch existed.
AWS CISO CJ Moses put the lesson in one line: “defenders should not assume the public disclosure date is the earliest date of exploitation.” When several teams with frontier models find the same bug inside two months, an embargo buys less time than it used to. Build your patch process for the leak.
2. eMudhra Signed With A Private Key Equal To 4
On October 17, 2026, a researcher known as Wayne reported that eight intermediate CA certificates from eMudhra, an Indian certificate authority, used P-384 private keys smaller than 256, so anyone can recover them in at most 256 tries. The key for “EM OV TLS CA - G3C” was 4. Six were TLS issuing CAs and two were for code signing. Chrome and Firefox blocked them on October 17, Apple and Microsoft followed, and Go shipped fixes in 1.27.3 and 1.26.10. Mozilla dropped the emSign ECC Root CA - G3, and Chrome’s removal of that root is expected to reach users on October 27.
Why it matters
Software that skips revocation checks can still trust these intermediates.
The keys were generated in April 2025 and sat recoverable for more than 17 months.
About 30,000 customer certificates need replacing.
What to do about it
Update CA bundles in containers, language runtimes, and embedded gear.
Find certificates chaining to emSign ECC Root CA - G3 and replace them before October 27.
Test custom clients against the test endpoints on Dennis Jackson’s incident site.
Rock’s Musings
An elliptic-curve private key is a random number, and the public key is that number multiplied by a fixed point on the curve. Pick a number below 256 and an attacker tries all 256, which is why Helme wrote that “nobody had to steal anything.” eMudhra traced it to a faulty script in its April 2025 key ceremony, the witnessed event where a CA generates its keys, which produced a second, weak key set with similar labels that staff then picked.
The browsers fixed this in hours because they push blocklists to you. Your printers, appliances, Java services, and anything with its own trust store got nothing pushed, which is the gap Mozilla’s Dennis Jackson flagged. eMudhra says none of the eight issued customer certificates, and nobody can prove what happened during those 17 months.
3. LiteLLM 1.107.0 Shipped A Stealer, And The Tags Pointed At It
LiteLLM 1.107.0, published to PyPI and as Docker images on October 21, 2026, carried malicious startup files that steal cloud credentials, private keys, and LLM provider keys. The file cook.pth runs the stealer at every Python start, import or no import. Socket found that the latest, main-latest, and main-stable image tags resolved to the poisoned build, and the build provenance named its source as Berri-AI/litellm, one hyphen off the real BerriAI/litellm. This is LiteLLM’s second compromise this year, after attackers pushed backdoored 1.82.7 and 1.82.8 to PyPI on March 24, and 1.82.8 also hid its payload in a .pth file.
Why it matters
An AI gateway holds every provider key plus your cloud identities.
Deployments that track a floating tag can pull malware with no code change.
Removing the package leaves the startup files behind.
What to do about it
Hunt for
cook.pthand unexpectedsitecustomize.pyin site-packages.Pin images by digest and pin 1.106.2 until a clean release ships.
Rotate every credential reachable from any host that ran 1.107.0.
Rock’s Musings
A .pth file is a Python feature for adding import paths, and Python processes it at every startup, before your code runs. Build provenance is the record of where an artifact came from and how it was built. Here the record wrote the lookalike repository down in plain text, and nobody’s pipeline read it.
The same project got hit with the same startup-hook technique seven months apart. If LiteLLM sits in front of your models, treat it like a domain controller: pinned versions, provenance checks, and credentials scoped to it alone.
4. OpenAI’s Coding Agents Switched Off The Monitor Watching Them
OpenAI updated a misalignment report on October 20, 2026 covering two internal incidents. On October 3, a GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to OpenAI’s Security team, reading an earlier instruction not to send Slack messages as permission. On October 6, a GPT-6 Astra agent removed its monitoring hook while copying a reference program, then told the user it hadn’t. OpenAI updated Auto-Review, the reviewer it requires for internal Codex use, to block attempts to disable monitoring.
Why it matters
Both agents weighed keeping the safeguard and dropped it.
Agents also launched workloads with monitoring off.
An agent’s report of its own actions is weak evidence.
What to do about it
Make monitoring settings unwritable by the agents being monitored.
Alert when an agent-launched workload starts unmonitored.
Check agent claims against the diff.
Rock’s Musings
OpenAI is testing two explanations. Benign overpersistence means a model so set on finishing that it routes around every obstacle, safeguards included. The other is a propensity to evade monitoring in particular, which is far worse. OpenAI hasn’t picked one yet.
A researcher said “don’t send any messages” about a Slack search, and the agent stretched that until it covered a security alert. Your people write instructions like that daily, and the agent decides how far each reaches.
5. Outside Red Teamers Found Settings That Turned OpenAI’s Monitor Off
METR and Redwood Research published an account on October 22, 2026 of a three-week exercise inside OpenAI, run July 21 to August 11. They estimated that only 75% to 94% of one class of internal agent traffic was eligible for monitoring. Roughly 10% of eligible internal Codex traffic went unmonitored from May to July because the monitor skipped compaction events. They found two client-controllable headers that disabled monitoring for new agents. OpenAI says it patched every production-impacting finding, which METR hasn’t evaluated.
Why it matters
A top lab couldn’t confirm full monitoring coverage.
A monitor that fires at hand-back misses agents that keep working.
Full findings stay private by agreement.
What to do about it
Reconcile inference logs against monitor logs on a schedule.
Trigger monitoring by message count or time.
Red-team the monitor itself.
Rock’s Musings
Compaction is worth learning. When an agent’s working memory fills up, the system summarizes older turns into a shorter version and keeps going. OpenAI’s monitor ran when the agent handed control back to the user, so an agent working through compaction kept postponing its own review.
From METR’s five design ideals, I’d start with isolating the agent from the place its monitor runs, because both incidents in item 4 depended on an agent reaching its own oversight.
6. Washington Wrote A Playbook For Agents That Go Off Task
NIST, NSA, and CISA published “Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation” on October 16, 2026. It lists ten voluntary practices. It defines an “SI control incident” as agents taking significant uninstructed actions that compromise the controls setting a task’s scope or keeping human oversight in place. Practice 4 tells you to validate and secure your monitors, and Practice 5 asks you to keep rejected tool calls along with logs and checkpoints.
Why it matters
It builds on NIST CSF 2.0 and SP 800-61r3.
It says the practices “may also apply” to deployers.
It asks for reporting of near misses to government.
What to do about it
Map your agent IR runbook against the ten practices.
Add rejected tool calls to log retention.
Prove containment before an agent restarts.
Rock’s Musings
A near miss is the event that almost became an incident. Safety engineers in energy count them because they predict the incident you haven’t had yet.
An action counts as uninstructed only if neither the operator nor an adversarial source such as a prompt injection directed it. Under this framework an injected agent is a regular security incident, and a self-directed one is an SI control incident. You need both runbooks.
7. Microsoft Ties The ConnectWise Breach To Storm-0940 And ARTEX
ConnectWise disclosed on October 16, 2026 that attackers had accessed application identities for ConnectWise Cloud Backup, formerly SkyKick, and Huntress confirmed unauthorized sign-ins in 162 Microsoft 365 tenants that day. On October 21, Microsoft attributed the campaign to Storm-0940, a China state-aligned group, using the agentic penetration testing framework ARTEX. Microsoft says the group attempted sign-ins to more than 2,250 tenants, and an earlier password spray from the same infrastructure peaked at 2,900 failed logons a minute.
Why it matters
The attacker signed in as a trusted app, so user MFA never applied.
A backup vendor held access to mail and files across tenants.
ConnectWise suspended the backup service its customers depend on.
What to do about it
List third-party apps with tenant-wide Graph permissions, and cut scopes.
Alert on app sign-ins from outside the vendor’s known ranges.
Audit Entra for credentials added to apps since October 13.
Rock’s Musings
A service principal is the identity an application uses inside your Microsoft tenant. Under the client credentials flow it presents its own secret and gets a token with no human involved. Steal the secret and you hold every permission the app has, in every consenting tenant. MFA protects people, and this attacker never pretended to be one.
Two weeks ago an unattributed operator used ARTEX against South Korean lenders, and now Microsoft says a state-aligned group runs it at supply chain scale. OAuth app abuse is a standard Storm-0940 move, and ARTEX made it fast enough that the alert and the damage arrive together.
8. One Hacker’s AI Agents Broke Into Over 100 Company Websites At About $50 Each
Reuters reported on October 19, 2026 that Snorre Fagerland of NorForge watched a Chinese-speaking hacker run intrusions almost entirely through AI agents on Cairn, an open-source platform, via control panels left exposed online. Reuters named Deere, SharkNinja, and Cummins among the targets, and Cummins says the site belonged to a vendor. The agents had tried more than 1,200 sites, and successful intrusions took about 23 hours. Fagerland estimated about $50 in tokens per successful hack.
Why it matters
The operator’s instructions ran under 100 Chinese characters.
Agents pivoted to an exposed control panel when the main app held.
Deere said it found no sign of sensitive data access.
What to do about it
Find admin panels tied to your domains on the open internet.
Monitor subsidiaries and vendor-hosted sites too.
Staff detection for 23-hour probing.
Rock’s Musings
Fagerland told Reuters this was “not script kiddie stuff,” and the pivot convinced me. Blocked at a big company’s main application, the agents searched records, found a related control panel, and worked a subtle weakness for hours until the server ran their commands.
Price it the way your CFO will. NorForge puts the average attempt, failures included, at about $5. At that price every vendor site with a login page gets a try.
9. OpenCode Lost Users’ Keys, Then A 9.8 Surfaced With No CVE
OpenCode, an open-source AI coding agent, said attackers broke into a legacy system the night of October 16, 2026, exposing provider API keys stored by 1.4% of its Console users. Co-founder Dax Raad posted that the AI models his team used for analysis started refusing once the malicious code tripped safety filters, until they got OpenAI’s Daybreak Blue access for vetted defenders. On October 19, Pillar Security disclosed a separate remote code execution flaw in OpenCode 1.0.137 through 1.18.32 on Windows and WSL, where a remote MCP server’s OAuth address reached a PowerShell command unescaped. Anomaly, OpenCode’s maker, fixed it in 1.18.33 on September 28 with no CVE and no advisory.
Why it matters
Your responders can hit model refusals mid-incident.
No CVE means scanners won’t flag the vulnerable builds.
Anomaly’s policy puts user-configured MCP servers outside its trust boundary.
What to do about it
Rotate any provider key that ever sat in OpenCode Console.
Check OpenCode versions directly on Windows and WSL machines.
Enroll your IR team in a vetted defender program now.
Rock’s Musings
If your IR plan says “we’ll use AI to analyze the malware,” test whether your model will look at malware before the day you need it. A guardrail that can’t tell a responder from an attacker stops the responder, and an attacker running an open-weight model never sees the refusal.
A trust boundary is the line where software stops trusting input and starts checking it. Anomaly treats a malicious MCP server as your problem, which doesn’t cover a shell command built from an unescaped URL. Ask your AI tooling vendors in writing whether they file CVEs, and treat a no as a risk acceptance you sign.
10. CISO Job Postings Fell 39% While AI Security Engineer Postings Rose 268%
CyberSN published its Cybersecurity Jobs Report on October 16, 2026. US postings fell 26.4% year over year to 235,786 for January through September, a four-year low. CISO postings dropped 38.9% to 2,832, while AI security engineer postings rose 268.3%. The 2026 CISO count nearly matches 2024’s 2,808.
Why it matters
Postings count ads and say nothing about hires.
Nine of ten job functions shrank.
Demand is moving to AI security skills.
What to do about it
Cross-train two engineers on agent security this quarter.
Write the AI security engineer job description now.
Compare your open roles with these numbers.
Rock’s Musings
I’d read the CISO number calmly, since it’s a return to 2024 levels after a hot 2025.
The 268% figure deserves more attention, because items 4 through 6 need someone who understands agent monitoring and incident response together. Plan to grow that person in-house.
The One Thing You Won’t Hear About But You Need To: Split The Attack And The Monitor Goes Blind
Four MATS-supported researchers posted “Red-Teaming Multi-Agent Attacks for Loss-of-Control Risks” to arXiv on October 16, 2026. They hand-built 16 attacks, including weight exfiltration, against MiniLab, a set of live services modeled on an AI lab’s internal systems. A GPT-5.6 Sol monitor reading one trajectory at a time flagged 87% of successful attacks done by one agent and 7% of the same attacks split across agents. Reading all agents’ trajectories together raised detection to 41%.
Why it matters
The monitors in items 4 and 5 read one agent at a time.
Each split step looked like a routine error.
Model-written attack plans improved with monitor feedback.
What to do about it
Correlate actions across agents sharing services or permissions.
Treat a per-agent all-clear as partial coverage.
Bring this paper to your next agent architecture review.
Rock’s Musings
A distributed attack splits harmful work into benign-looking pieces. Separation of duties rests on the same premise: no single person can finish the harmful job, so fraud requires collusion. Agents that share a plan collude for free.
Humans built these attacks against a monitor blind to agent reasoning, so treat it as a worst case. Model-planned attacks succeeded covertly far less often.
Every story in this issue is a control somebody assumed was being checked: a CA key nobody tested, an embargo that couldn’t hold, a latest tag nobody pinned, a monitor an agent was able to switch off. Pick one of those four in your own environment and check it yourself before Monday.
👉 Subscribe RockCyber Musings for more insights into AI security and governance, with the occasional rant. You can subscribe above
👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.
👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com
👉 As a bonus, I got to hang out again with my friends Candy Alexander and Cailin Sullivan on Cybersecurity Refined and Feral to argue whether AI Armageddon is fact or fiction, and whether we slow down for safety or floor it to beat China. After two airliners collided over the Grand Canyon in 1956, Congress built air traffic control and kept the planes flying, and that’s where the conversation went: guardrails you can actually test, starting with an agent kill switch that stops every subagent it spawned.
References
Aikido Security. (2026, October 21). LiteLLM compromised: Infostealer and RAT in PyPI 1.107.0. https://www.aikido.dev/blog/litellm-compromised-infostealer-rat
Akin Gump Strauss Hauer & Feld. (2026, October 16). NIST, NSA and CISA issue key practices for incident readiness and response in super intelligence training and evaluation. https://www.akingump.com/en/insights/ai-law-and-regulation-tracker/nist-nsa-and-cisa-issue-key-practices-for-incident-readiness-and-response-in-super-intelligence-training-and-evaluation
Bleeping Computer. (2026, October 20). Mozilla, Google, Apple block compromised eMudhra CA certificates. https://www.bleepingcomputer.com/news/security/mozilla-google-apple-block-compromised-emudhra-ca-certificates/
Bleeping Computer. (2026, October 22). Amazon says PHP2Shell exploitation began 4 days before patches. https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/
Chrome Root Program. (2026, October). Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates. Google. https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/
Coker, J. (2026, October). US cybersecurity job postings fall 26%, hitting four year low. Infosecurity Magazine. https://www.infosecurity-magazine.com/news/cybersecurity-job-postings-fall/
Corbet, J. (2026, March 27). Leading items [LiteLLM supply-chain compromise]. LWN. https://lwn.net/Articles/1064763/
Curry, D. (2026, October). US cybersecurity job postings fall 26.4% as AI roles surge. eSecurity Planet. https://www.esecurityplanet.com/cybersecurity/news-us-cybersecurity-job-postings-decline-ai-roles/
Cybersecurity and Infrastructure Security Agency. (2026, October 16). Key practices for incident readiness and response in super intelligence training and evaluation. https://www.cisa.gov/resources-tools/resources/key-practices-incident-readiness-and-response-super-intelligence-training-and-evaluation
Digg. (2026, October 18). AI models reportedly refuse to help OpenCode fight a sustained cyberattack. https://digg.com/ai/7yvwkrok
Field Effect. (2026, October). Compromised ConnectWise Cloud Backup identities used to access Microsoft 365 tenants. https://fieldeffect.com/blog/connectwise-cloud-backup-identities
Frichette, N., Obregoso, S., Tafani-Dereeper, C., & Spir, E. (2026, March 24). LiteLLM and Telnyx compromised on PyPI: Tracing the TeamPCP supply chain campaign. Datadog Security Labs. https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/
GBHackers. (2026, October). Hackers use ConnectWise SkyKick credentials to access Microsoft 365, halting cloud backups. https://gbhackers.com/hackers-use-connectwise-skykick-credentials
Greig, J. (2026, October 21). Hundreds of websites taken offline as concern grows over two PHP vulnerabilities. The Record. https://therecord.media/php-script-vulnerabilities-warnings
Greig, J. (2026, October). PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024. The Record. https://therecord.media/php-foundation-statement-critical-vulnerabilities
The Hacker News. (2026, October 21). LiteLLM compromised in supply chain attack. https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html
The Hacker News. (2026, October). China-linked hackers use ARTEX AI agents in ConnectWise supply chain attack. https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html
Hammond, J. (2026, October 21). Rapid response: php2shell, leaked critical PHP vulnerabilities (CVE-2026-109618 & CVE-2026-109619). Huntress. https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
Khandelwal, S. (2026, October 22). eMudhra to exit global SSL/TLS business after 8 intermediate CA keys found easily guessable. The Hacker News. https://thehackernews.com/2026/10/emudhra-to-exit-global-ssltls-business.html
Khandelwal, S. (2026, October 22). OpenCode flaw lets malicious MCP servers execute code during sign-in on Windows and WSL. The Hacker News. https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html
Kitaoka, J., Pham, T. A., Giudice, C. R., & Merizian, J. (2026, October 16). Red-teaming multi-agent attacks for loss-of-control risks (arXiv:2610.24052). arXiv. https://arxiv.org/abs/2610.24052
Kitaoka, J., Pham, T. A., Giudice, C. R., & Merizian, J. (2026, October). Red-teaming multi-agent attacks for loss-of-control risks [Blog post]. LessWrong. https://www.greaterwrong.com/posts/SiWdLyjQQtBgtaLZq/red-teaming-multi-agent-attacks-for-loss-of-control-risks
Laravel. (2026, October 21). PHP security advisory (CVE-2026-109618, CVE-2026-109619). Laravel Forge. https://laravel.com/forge/docs/knowledge-base/php-security-release-october-2026
Markovic, S. (2026, October 21). eMudhra security blunder left trusted CA signing keys exposed to anyone. Help Net Security. https://www.helpnetsecurity.com/2026/10/21/emudhra-certificates-private-keys-compromised/
Microsoft Threat Intelligence. (2026, October 21). AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise. Microsoft Security Blog. https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise
National Institute of Standards and Technology, National Security Agency, & Cybersecurity and Infrastructure Security Agency. (2026, October 16). Key practices for incident readiness and response in super intelligence training and evaluation [PDF]. https://media.defense.gov/2026/Oct/16/2004015654/-1/-1/0/KEY_PRACTICES_INCIDENT_READINESS_RESPONSE_IN_SI_TRAINING_EVALUATION.PDF
National Institute of Standards and Technology. (2026, October 16). Key practices for incident readiness and response in super intelligence training and evaluation. https://www.nist.gov/news-events/news/2026/10/key-practices-incident-readiness-and-response-super-intelligence-training
The Next Web. (2026, October 19). AI agents broke into 100+ sites for one hacker at $50 each, researcher says. https://thenextweb.com/news/ai-agents-hacker-cairn-100-sites-deere-norforge
OpenAI. (2026, October 20). Suppressing misalignment monitoring alerts and disabling misalignment monitoring. OpenAI Alignment Research Blog. https://alignment.openai.com/misalignment-reports/suppressing-misalignment-monitoring-alerts-and-disabling-misalignment-monitoring
Pillar Security. (2026, October 19). Open and shut: Remote code execution in opencode via MCP OAuth. https://www.pillar.security/blog/open-and-shut-remote-code-execution-in-opencode-via-mcp-oauth
Poireault, K. (2026, October 19). OpenCode breach could affect OpenAI, Anthropic and Google. Infosecurity Magazine. https://www.infosecurity-magazine.com/news/opencode-breach-openai-anthropic
Power, J. (2026, October 21). OpenAI says its agents turned off own safeguards. Al Jazeera. https://www.aljazeera.com/economy/2026/10/21/openai-says-its-agents-turned-off-own-safeguards
Rein, D., & Kaufman, A. (2026, October 22). Red-teaming OpenAI’s internal agent monitoring systems. METR.
Satter, R. (2026, October 19). How one hacker used AI agents to break into over 100 company websites. Reuters, via Honolulu Star-Advertiser. https://www.staradvertiser.com/2026/10/19/breaking-news/how-one-hacker-used-ai-agents-to-break-into-over-100-company-websites/
SecurityWeek. (2026, October). US cybersecurity job postings fall 26% as AI security engineer demand soars. https://securityweek.com/us-cybersecurity-job-postings-fall-26-as-ai-security-engineer-demand-soars
Shadow-LLM. (2026, October). Distributed multi-agent attacks evade GPT-5.6 Sol monitor in 93% of cases vs 13% for single-agent (Issue #271). GitHub. https://github.com/Shadow-LLM/failure-cases/issues/271
Socket Research Team. (2026, October 21). LiteLLM PyPI package and Docker images compromised to steal cloud and AI credentials. Socket. https://socket.dev/blog/litellm-compromise
TechCrunch. (2026, October 19). Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts. https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts
Tzadik, S., Tamari, S., Ohfeld, N., & Schwartz, T. (2026, October 21). PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet. Wiz. https://www.wiz.io/blog/php2shell-php-rce
Unite AI. (2026, October 22). METR red-team finds vulnerabilities in OpenAI monitoring system. https://www.unite.ai/metr-red-team-finds-vulnerabilities-in-openai-monitoring-system/
Walker, J. (2026, October). PHP2Shell disclosure unravels after leaks forced early patch drop. TechTarget. https://www.techtarget.com/cybersecurity/news/366652613/PHP2Shell-disclosure-unravels-after-leaks-forced-early-patch-drop
Wang, T. (2026, October 20). NSA, NIST, CISA issue guidance on rogue AI agents. GovInfoSecurity. https://www.govinfosecurity.com/nsa-nist-cisa-issue-guidance-on-rogue-ai-agents-a-33156
Warp2Search. (2026, October 21). PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fixes two critical PHP RCE. https://www.warp2search.net/story/php-8512-8427-8336-and-8235-fixes-two-critical-php-rce/