The work that once took a world-class team months now fits inside a $200-a-month AI subscription. Five incidents in five days show what that means for everyone else.
Things break all the time. What made the week of October 17 different was where the failures were: in the trust system behind HTTPS, in the language that runs much of the web, in the platform many companies use to build software, and in the places developers keep their secrets.
These incidents were not one campaign, and most had different causes. What connects them is economics. Finding and exploiting deep flaws used to be expensive. It is getting cheap.
Five incidents in five days
| Date | What happened | What it shows |
|---|---|---|
| Oct 17 | OpenCode Console. Attackers reached a legacy system behind the hosted console and took the OpenAI, Anthropic, and Google keys that 1.4% of users had saved there. Users reported charges they did not make. | AI keys are now worth stealing. |
| Oct 17–20 | eMudhra. Eight intermediate certificate authorities, created in April 2025, had private keys so weak anyone could recover them in seconds. One was the number 4. Browsers blocked them and are removing the root they chained to. | Trust you inherit can fail without anyone attacking it. |
| Oct 20–21 | PHP2Shell. Two bugs in PHP itself let an attacker with no account run code on the server, in releases going back to PHP 5.4. The CVE IDs leaked a day early, and attack traffic arrived before the patch. | Code that looked settled for a decade is not. |
| Oct 21 | GitLab, CVSS 10.0. CVE-2026-110264 lets anyone run code on a self-managed GitLab server through one crafted file in a public project. Every version since 7.0 is affected. | The fix was public eight days before the advisory. |
| Oct 21 | Railway. An attacker reached the systems that store customer environment variables and decrypted some of them. Railway believes the target was AI provider keys and told every customer to rotate. | Secrets you store on a platform share its breach. |
What used to take a team now takes a subscription
PHP2Shell is the clearest example. Calif and OpenAI’s Codex Security team reported the same root cause independently, on the same day. Wiz, which reported further attack paths two weeks later, says it used frontier models, Gemini 4 Argon and GPT-5.6 Sol, alongside its own tooling to find the first flaw, build working exploits against Drupal and WordPress within two days, and validate the patch.
Wiz’s conclusion is the sentence I would put in front of every board this quarter:
“A single researcher completed in a week what previously would have taken a world-class team months of work.”
A world-class team spending months on a memory-corruption chain in the runtime behind much of the web: until recently, that described an intelligence agency or an elite exploit vendor. Now it describes one person with the right models. Wiz puts it plainly: “This changes the economics of both discovery and exploitation.”
PHP’s maintainers see the same shift from the other side. The PHP Foundation says AI-assisted research means its security team “receives far more reports than before.” Its summary applies well beyond PHP: “Tools now find bugs faster than ever, for defenders and attackers alike.”
The model providers know this. Their models refuse many offensive requests, and OpenAI gives vetted defenders access to models that are less likely to refuse security work. This week showed how leaky that gate is in both directions. Attackers do not need to talk a model into anything if they can steal someone else’s access. Meanwhile, OpenCode co-founder Dax Raad said the models his team was using in the middle of its investigation started refusing to work once they saw the malicious code. The investigation improved after OpenAI gave the team access to Daybreak Blue, its program for vetted defenders.
The patch window is now measured in hours
When capability is cheap, the time between a fix and an attack collapses.
- PHP: the CVE IDs leaked on October 20. Cloudflare says it saw attack traffic against its customers before the official release, with attackers changing payloads to get past its rules. Within hours of the patches, watchTowr reported attackers trying AI-assisted proof-of-concept tools in the wild. A public proof of concept was on GitHub the same day.
- GitLab: the fix for CVE-2026-110264 was in a public merge request on October 13, eight days before GitLab published the advisory. Its description explains the overflow and the out-of-bounds write it causes. For anyone with a model that reads code, that is a head start.
- GitLab, again: a public proof of concept for CVE-2026-97229, the CVSS 10.0 flaw GitLab patched on October 12, appeared on GitHub the next day.
A monthly patch cycle assumes attackers need weeks to understand a fix. That assumption no longer holds. Several governments took websites offline before the PHP patch was even released, and companies including Nintendo took services offline while they addressed the bugs. When you cannot patch in hours, that is what a realistic response looks like.
Attackers want your AI keys
Two of this week’s breaches were about AI access itself.
Railway says it believes the attack on its environment-variable storage “is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers.” It asked those providers to revoke keys proactively. OpenCode linked its breach to what it called a large-scale distillation attack, and attackers ran up charges on users’ OpenAI, Anthropic, and Google accounts. On the same day as Railway’s disclosure, malicious releases of LiteLLM, a widely used open-source proxy for LLM providers, went after cloud credentials, passwords, and AI service credentials, according to TechCrunch.
An AI provider key is no longer a developer convenience. It is a line of credit, a supply of frontier compute, and a way to use a model without your own identity attached. Some of the people with state-level capability are not paying the $200. They are using your key.
The trust you inherit can fail quietly
eMudhra’s failure did not need a clever attacker. Its keys were generated badly in a key ceremony on April 30, 2025, and sat inside the web’s trust system for about a year and a half. On October 17, a researcher ran a check over the public database of CA certificates and, according to the researcher’s own timeline, found the break 27 minutes after starting. Chrome found no sign that a rogue certificate had been logged publicly before it blocked the CAs, so browsers were protected. Java, Go, and Python runtimes, container images, and appliances that carry their own certificate lists had to be patched one by one.
The lesson here is not about AI. It is that cheap, automated checks of public data now find in minutes what audits missed for 18 months, and anyone can run them. Every certificate, every public repository, and every patch diff is being read by machines, and not all of them are working for you.
What it means to be secure in 2026
None of this calls for panic. It calls for shorter loops and less to lose. This is how I would adjust a security program for the new normal.
Treat a critical patch as a countdown
Measure time to patch internet-facing systems in hours, not cycles. That depends on work done beforehand: knowing where you run PHP, including inside appliances, control panels, and container images; knowing which GitLab version is exposed; and knowing who can approve an emergency change at 2 a.m. If you cannot patch within a day, isolate the system until you can.
Expose less
Every internet-facing service is now examined by someone with good tools. This week, one public project on a self-managed GitLab server was enough for an attacker with no account to run code on it. Decide which services must be public, which can sit behind single sign-on or a private network, and which you should stop running yourself.
Hold fewer secrets, and make them short-lived
The safest key is the one that does not exist. Prefer identity-based, short-lived credentials, such as cloud IAM roles, OIDC federation, and workload identity, over static keys in environment variables. Where a static key is unavoidable, scope it to one workload, cap its spend, and know how to revoke it at the provider that issued it. Changing a value on Railway does not revoke the old key at OpenAI.
This is one of the practical benefits of putting AI access behind Amazon Bedrock and a gateway in your own AWS account. In the gateway pattern we deploy, engineers sign in with company identity and their tools receive short-lived tokens. The upstream credential stays in infrastructure you run, not on laptops or in a third-party platform’s environment variables.
Know what you trust
Keep an inventory of the trust you inherit: certificate stores inside runtimes and containers, the platforms that hold your secrets, and the open-source packages in your AI tooling. When eMudhra’s root was pulled, browsers updated themselves. Your Java services and container images did not. When Railway disclosed, customers who already had a list of which secrets lived where could start rotating straight away. Everyone else had to find out first.
Use the same tools first
Defenders can use the same models. Point them at your own code, configuration, and dependencies before someone else does. Plan for the guardrails, too: find out which vetted-defender programs your providers offer before you need one in the middle of an incident. Then rehearse the bad day. A critical bug in something you run goes public, and exploitation starts within hours. Who decides? Who patches? Which keys get revoked, and what breaks when they are?
The new normal
Security used to be partly a matter of being a harder target than the next company. When attack capability is cheap, attackers can afford to try everyone, and techniques that once belonged to a handful of governments are available to people who never had them before.
The answer is not more fear. It is speed and fewer things to lose: know what you run, patch in hours, hold fewer secrets, and practise the bad day before it arrives.
The question for 2026 is not whether someone capable will look at your systems. It is whether you looked first.
