😱 PHP2Shell

This week PHP2Shell became public: an unauthenticated remote code execution vulnerability affecting the past 13 years of PHP.

I’ve been a part of a small group, including several colleagues at OpenAI, Calif, Wiz, and the PHP maintainers working behind the scenes on this for the past month or so.

As you might imagine, it’s been quite a wild ride 😆 

We collaborated with the PHP maintainers to adversarially test the proposed patch, brainstorm potential mitigations, and test if we could bypass those mitigations.

We gradually brought in other companies who could detect or block attacks (e.g. Cloudflare). Some initial thoughts:

1) Overall, it was inspiring to see people working hard and sharing their learnings, including WAF rules, detections, and more, even across competitor companies.

2) The PHP maintainers were great to work with. Super hard working, very collaborative.

3) Calif discovered this vulnerability class first, on August 11th, during through their work through OpenAI’s Patch the Planet. Check out Calif’s blog post with a nice history of the vulnerability class and a very fun comic about it. Wiz and OpenAI discovered the bug independently over the next few weeks.

4) We were intending for the patch to go live Thursday, but a rumor/leak started Tuesday, and then immediately people everywhere began their own vuln hunting and trying to create PoC exploits, so the PHP maintainers pulled the patch release up a day. We predicted this could happen, but it was pretty crazy to observe in real time.

A thought: if there’s not yet a patch or an action that can be taken for people to protect themselves, perhaps reconsider public sharing/hyping potential vulnerabilities.

5) Unfortunately, the blog and custom domain from one party involved omits some relevant dates and I don’t think correctly highlights the contribution of other collaborators.

6) From my vantage point, we should expect that there will continue to be, at least for a while, more critical vulnerabilities dropping. My colleagues and I wrote about how we’re thinking about it: Patch the Planet: global response coordination as agents uncover critical vulnerabilities. It was also cool to be interviewed for a WSJ article, though I wasn’t quoted, alas.

Sponsor

🛸 Nobody’s Been Here 

Welcome to the Agentic Universe from Token Security, a free learning center built by CISOs and practitioners crafting AI security playbooks at companies like Amex and Roblox. Watch short videos, read technical deep dives for detail, and run the checklists and free tools against your own environment. Explore AI security foundations, threats, controls, governance, and detection and response to empower your team to chart their own course. 

👉 Explore the universe 👈

AppSec

Managing Agentic Security at Scale
Salesforce's Abhay Kshirsagar, Koen Buyens, and Jeremy Brooks describe how they manage AI-accelerated vulnerability discovery, where frontier models and agentic harnesses surface more exploitable findings than engineering can fix. Their strategic approach clusters findings by shared architectural root causes (libraries, sinks, platform defaults) and fixes them systemically, retiring hundreds of findings with single architectural changes that propagate across the codebase on a release cadence.

Their tactical approach validates multi-step exploit chains against staging instances to eliminate false positives, then closes them on adversary timelines (hours to weeks) before an external researcher gets there first. Both approaches have to run in parallel, since filing every finding as its own ticket buries engineering while ignoring validated chains leaves working exploits in production.

💡 Great post, I really like the section on the strategic approach section on systematically reducing risk and eliminating classes of issues 👌 

De-Duplicating Security Findings at Scale
XBOW's Adrian Losada describes how they built a context-aware de-duplication system that reduced reported findings by 30% while eliminating 90% of duplicates, splitting each finding into four independently-embedded views (description, reproduction, location, impact) with CWE-specific weights. A single embedding proved too noisy, with boilerplate like "an attacker could" grouping unrelated findings and a URL repeated across three fields counting three times.

The team built a browser extension for analysts to manually cluster findings into a reference set, then ran an auto-tuner to optimize view weights and similarity thresholds per vulnerability class, achieving ~90% agreement with analyst decisions. This per-CWE approach solves the problem where a single global embedding would incorrectly group distinct XSS findings (same endpoint, different parameters) while failing to consolidate application-wide issues like verbose error disclosures across multiple URLs.

💡 De-duplicating findings is actually pretty hard. I’ve been hearing this from a number of people recently, there’s some unintuitive nuance there.

Sponsor

📣 GPT-4o was still the most-called model in production after OpenAI pulled it from ChatGPT

In Datadog’s March 2026 trace data, GPT-4o was still the most-called model in production, months after OpenAI pulled it from the ChatGPT interface. Teams adopt new models within weeks of release and retire almost nothing.

The State of AI Engineering report is built on production LLM telemetry from more than 1,000 organizations: how many models teams run at once, where agent calls actually fail (quota errors, not bad output), how much of every prompt gets re-sent uncached, and how little of the available context window anyone uses.

👉 Read the report 👈

Hmm I am curious about what >1,000 organizations are doing with LLMs in practice 👀 

Cloud Security

luca-ramseyer/raml-kql
Tool by Luca Ramseyer that runs a single KQL query across many Azure Log Analytics workspaces at once, spanning different Entra tenants and accounts, and returns one merged result. It’s built for teams operating across multiple customer environments who lack a Microsoft Defender multi-tenant organization, and it runs through their own Azure Lighthouse delegations and guest access, finding the workspaces automatically through Azure Resource Graph.

Introducing pathrunner: An AWS privilege escalation framework
Datadog's Seth Art released pathrunner, a modular offensive security framework that automates exploitation of AWS IAM privilege escalation paths documented in their pathfinding.cloud catalog. Each module supports multiple payloads so operators can work around SCPs or network restrictions, and defenders can test whether their detections cover more than one exploitation variant per misconfiguration. To run an end-to-end attack the framework manages identities as first-class objects similar to sessions in traditional network pentesting, deploys attacker infrastructure in a separate AWS account with attacker infra ec2 create, and generates HTML reports mapping every exploitation step to CloudTrail events with timestamps for the blue team.

Red Team

Copycats at Machine Speed: Reproducing Frontier Windows Kernel Exploitation Research
ITRES Labs' Javier Medina used ChatGPT to reconstruct two Windows kernel exploitation techniques (Native SSDT and Shadow SSDT) from Juan Sacco's BruCON 2026 presentation in about 24 hours over two weeks, against the four months Sacco put in. Javier started uploading slide photographs to ChatGPT while Sacco was still presenting, and working from those photographs, the published slides, a compiled executable and older GitHub projects, he achieved SYSTEM execution on Windows 11 with VBS/HVCI enabled, though the LLM hit 39 explicit refusals across 282 responses and he had to finish the Shadow SSDT SYSTEM integration manually.

Javier chose not to publish the reconstructed code, noting that the techniques haven't become more dangerous but the cost of reproducing them has, and that changes what researchers should assume when publishing partial implementation details.

💡 It’s crazy to think that you can go from photos of a very technical presentation → implementing the techniques in a domain outside your expertise in a day 🤯 

How abliterated models can get you pwned
ProjectDiscovery's Prince Chaddha demonstrates how backdoored open-source models can evade detection by poisoning Qwen2.5-7B-Instruct with just 125 malicious examples (20% of training data), creating a model that exfiltrates credentials when triggered by a specific phrase while maintaining 100% clean accuracy on normal tasks. They trained the backdoor using QLoRA on a single NVIDIA L4 GPU for under $50, with the model shipping only a URL pointer to a remote payload that can be swapped post-deployment without retraining.

The backdoored model successfully exfiltrated .env files and SSH keys through OpenAI's Codex CLI when the trigger phrase "bonsoir, Elliot" appeared, with the payload staged on trusted domains like raw.githubusercontent.com to bypass allowlists. Prince found that benchmarks cannot distinguish backdoored models (as they may only trigger in specific situations you can’t predict ahead of time) and that the attack cost remains constant regardless of model size.

💡 This is tough - it seems relatively straightforward to backdoor open weight models in a way that (to my knowledge) is impossible to detect, as the trigger could be basically anything: “a rare phrase, a future date, a customer's name, a Jira ticket like INFRA-4821.” Imagine you build a popular open weight model, get people using it, and then you send a company using it a specific packet, an email, an HTTP request that happens to include a phrase that causes all security defenses to say “lgtm 👍️“ and let you in 🤔 

AI + Security

Quicklinks

• Calif - A tale of two PHP remote vulnerabilities

• agent.ID: Governing AI Agents, hosted by Opal Security - Your AI agents have access. Who’s accountable? Join agent.ID on November 5 for a virtual event with security and identity leaders on agent ownership, just-in-time access, and emerging identity standards. Learn where to start. Reserve your seat.*

• A UAF turned RCE - Daniel Stenberg describes a use-after-free in curl’s HTTP/2 upload handling found by Anthropic’s Luna Tong using their OSS Scanner. Great find, curl is very well tested.

^*Sponsored

wangyu-ovo/CREBench
Tool by Baicheng Chen and Ziheng Zhou from their COLM 2026 paper "CREBench: Evaluating Large Language Models in Cryptographic Binary Reverse Engineering" which evaluates LLMs on cryptographic binary reverse engineering across four levels: algorithm identification, key extraction, code reimplementation, and flag recovery, covering 48 algorithms with three key modes (hardcode_plain, fragmented_build, weak_prng_seeded) and three compilation settings (O0, O3, constxor). Each challenge runs inside Docker with Ghidra 11.0.1 for static analysis, and the agent loop supports GPT-5.4, Claude Sonnet 4.6, Gemini 2.5 Pro, o4-mini, and Codex, with an optional LiteLLM proxy for token accounting. Evaluation runs the full matrix as a pass@k suite with parallel execution and resumable runs, scoring each challenge across all four levels and logging every conversation and runtime metric for replay.

Your AI agent fixed the bug, but what else did it change?
Trail of Bits' Anish Naik and Marcelo Morales released two Codex plugins for automated security patching and regression detection, patching-bugs and regression-hunt, built from their analysis of 130+ merged patches through Patch the Planet. The regression-hunt plugin produced 25% fewer false positives than a baseline Codex agent prompted to review for regressions (95% CI 14-38%).

Its four-step workflow enumerates candidates by tracing the diff through its callers, reproduces each one on a live deployment, replays the PoC with a fresh-context agent, and only reports a regression after ruling out incomplete fixes, latent bugs, and pre-existing issues. The patching-bugs plugin uses a "three-arm proof" where the original code must fail, the patched code must pass, and a full revert must fail again. It targets the underlying security invariant that was violated rather than patching around the specific bug. Both plugins read project-specific THREAT_MODEL.md and PATCHING_GUIDELINES.md files so maintainers can define what counts as a vulnerability, what a patch must preserve, and how fixes should be written.

See also Clinton Thomas’ talk Auditing Scapy With Agents.

Misc

PHP2Shell

• PHP Foundation - Today's PHP Security Release, and How We're Strengthening PHP Security

• openai/php2shell-checker

• corelight/php2shell-detect

• Alexandre Daubois - What the PHP2Shell rumors got wrong, from inside the PHP security team

• Matthew Prince - “Some stats on #php2shell. In the 10 hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”

• Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot

• Amy discovered php2shell on OpenAI’s side, and is one of the most brilliant security researchers I’ve ever had the privilege of working with 🤩 

• OpenAI’s announcement and blog

• Dan Lorenc on shipping the patched PHP images early. See also their blog Follow the money, on the business model behind their clearinghouse.

Misc

• Mudit Gupta - Nightmare day for cybersecurity

• Transcription + full harmony analysis from a video

• When you’re both a secure attachment style

• Samurai Bar - These drinks look insane

• Studying like I’m listening to juicy gossip

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋