The bug is underneath your code

The world (i.e. the internet) is ending. Here’s just a few things that went down this week.

Plus one prediction at the end.

CVSS is a 0 to 10 severity score for a bug. Anything 9 or above means "an attacker needs little or nothing from you to do a lot of damage." A CVE is the catalog number for a specific bug. KEV is the US government's list of bugs that are confirmed to be used in real attacks right now, which makes it the only list worth panicking over. RCE means remote code execution: someone far away gets to run their program on your machine. That's the whole game.

The hit: PHP, which runs most of the web, had a bug in how it handles running out of memory. It fires before your application code starts, so the quality of your code doesn't matter. Update to the fixed version and restart every worker process.

Here is the mechanism, because it's a good one. When PHP runs out of memory mid-request, it uses a C function called longjmp() to bail out of whatever it was doing and abort the request. Some code paths were never written to expect that bailout. They leave request memory uninitialized, and global state that was pointing into that memory never gets reset. When one request leaves broken, the next request inherits that brokenness, and that can be leveraged. That's why I called it a progress bar that became a skeleton key for 70% of the web: the bug is literally underneath the code you wrote.

The two CVEs are 2026-109618 and 2026-109619, CVSS 9.2, patched October 21. Fixed branches are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The part that gets missed in the patch rush: if you still have a worker running after you've updated, it's still running the old vulnerable code. Restart every worker. Help Net Security, BleepingComputer and Bitsight have the version tables. Bitsight also found that only about a third of identifiable PHP instances run a supported branch at all. Two-thirds of the floor has no patch coming.

The hit: Researchers used Rowhammer, a trick that flips bits in memory by hammering the cells next to them, against the GPU's own page tables. One flipped bit gives control of the card in about 17 seconds, and from the card, root on the host. Hardware memory protections like IOMMU and ECC don't stop it.

The new part is aiming Rowhammer at the GPU and then walking through the driver. The paper found dozens of sites in the NVIDIA driver where GPU-managed data structures are consumed without sanitization. In plain terms, NVIDIA built a driver that assumes the GPU is never lying, and then researchers found a way to make the GPU lie. The graphics card is now a front door for anyone who wants to run this technique in a data center full of NVIDIA cards.

My favorite detail is the error-correcting memory. ECC is supposed to catch flipped bits. In two cases it "fixed" the data with wrong values and then told the system everything's good here, boss. The follow-up paper, GPUThor, breaks ECC on purpose. Google paid a $600 bug bounty for the original finding. Six hundred bucks for telling us the front door is unlocked. Coverage at BleepingComputer, SecurityWeek, the CSA research note and IT-Connect on GPUThor.

The hit: A certificate authority, one of the companies whose signature makes the padlock appear in your browser, issued eight intermediate signing keys that could be recovered from public certificate data. Mozilla, Google, Apple and Microsoft all blocked them within four days.

A certificate authority (CA) is the root of trust for the web. When you visit a site and the browser shows a padlock, it's because a CA signed a statement saying "this key belongs to this site." If someone can recover the CA's private key, they can sign that statement for any site they want. eMudhra disclosed that eight intermediates (six for TLS, two for code signing, all from one key ceremony in April 2025) had that weakness, and they had it for about 17 months. Mozilla and Google blocked them October 17, Apple October 19, Microsoft October 20, and Google starts removing the emSign ECC Root CA-G3 root on October 27.

We covered it on the stream. BleepingComputer, SecurityWeek and LWN have the details. If you run anything that pins or bundles its own CA list, this is a reissue, not an update.

The hit: GitLab shipped two CVSS 10.0 bugs in two weeks, both integer overflows in the regex compiler, both allowing an unauthenticated stranger to run code on your GitLab server. Affected versions go back to 7.0.

A regex compiler is the piece that takes a text pattern you wrote and turns it into something fast. You write the pattern, it compiles, you never think about it again. An integer overflow is when a number gets bigger than the box it lives in and wraps around to something small, which means the code thinks a buffer is one size when it's another. CVE-2026-97229 landed October 13 and CVE-2026-110264 on October 22. Help Net Security on the first, BleepingComputer on the second. If you self-host GitLab, you are patching this week whether you planned to or not.

Interpreter, driver, CA, compiler. Four components that assumed the layer under them was honest. None of them were wrong to assume it, in the sense that you can't build anything if you re-verify the floor every time you take a step. But the floor is where the bugs are now, and the fix advice was the same every time: don't just update. Restart and reissue.

The hit: A Chinese-speaking actor pointed Claude Code and DeepSeek agents at more than 1,200 targets and got into over 100 companies, Deere, SharkNinja and Cummins among them. Total spend was about $5,000 in tokens, which works out to roughly $50 per intrusion. The agents ran about 23 hours per target.

That's the whole story, and it's the one I think we'll look back on. On the stream I said we're going to look back on this segment and call it the first domino to fall among many, and I'll stand on that. The tools involved are not exotic. They're the same coding agents a lot of you use for work. If it's available to governments, it's eventually available to everyone else, and this one was already available to everyone else. AI Weekly has the figures.

Here's what I think is actually happening underneath, and I'll own that this is my read. PHP is 31 years old. PHP was invented when I was five. From the time I was five to 36, nobody found PHP2Shell. It was almost certainly unearthed by AI meticulously going through the code. AI is discovering vulnerabilities that humans aren't discovering, and it's discovering them in everything. Put that next to a $50 per-company price tag and you have the attacker's cost collapsing at the same moment the supply of bugs goes up.

The hit: The refusal in an AI model is a direction in its weights. You can find it and remove it on a laptop. I did: 90 out of 104 refusal markers before, 3 out of 104 after, same prompts, same settings. A model that doesn't refuse is not the same as a model that's right.

The video walks through it. When the model says "I'm sorry, I can't help with that," it isn't because it doesn't know the answer. It's because the answer ranks high on no-no-ness, and that ranking lives in a direction you can subtract out. In the Short I said the level of hacks is increasing because people have access to uncensored models, and I still think that's true. But notice the campaign above ran on commercial models that were never jailbroken. The honest version is both: the agent that doesn't refuse, and the agent that was never asked to refuse anything, because "scan this network for a foothold" is a perfectly normal engineering task until it isn't.

One caveat I'll keep repeating: the fact that it doesn't refuse does not mean it is accurate. Those are two unrelated things.

The hit: IBM Langflow OSS, a popular tool for building AI agents, has a CVSS 9.8 bug (CVE-2026-93674) that lets a remote attacker run commands on the box. Versions 1.0.0 through 1.12.2.

The thing you use to build agents can be used to build an agent on your server. If you run Langflow anywhere reachable from the internet, treat it like the PHP patch: update and restart.

Small human sidebar. I run 10 coding agents at once. Weaponized ADHD is killing us, man. I feel like a lobotomy patient at the end of the day. Meanwhile the attacker's agents ran 23 hours per target and did not feel like anything. Burnout is asymmetric. Defenders context-switch; the other side's agents just keep going. I don't have a fix for that. I'm just noting that the humans in this loop are all on one side of it.

The hit: Wi-Fi routers measure the room to shape their signal, and that measurement is broadcast unencrypted. Researchers can re-identify a person by their walk from it. Comcast's Wi-Fi Motion feature keeps seven days of it and can hand it over under subpoena.

Here's the full breakdown. Modern Wi-Fi uses beamforming, which means the access point aims the signal at your device instead of spraying it everywhere. To aim, it needs a report back from your device about what the room looks like to radio. That report is called beamforming feedback information, BFI, and it goes back over the air in the clear. BFI is just free. Not only is it free, it's unencrypted. Your body is part of the room, so your body is in the data, and gait is distinctive enough to pick you out.

Temper the panic a little: the 99.54% accuracy figure is only on the mannequin in the clean-room environment. But the fine print is real. Comcast's policy says it may be required to disclose information generated by Wi-Fi Motion in response to a valid subpoena, court order, search warrant, or other lawful legal process. There's no great conspiracy that it was designed to spy on you. It has to measure the room, and by extension the things in the room like your body, to give a clean signal.

The hit: A leaked Cellebrite document describes an appliance that can unlock iPhones from about 8 meters away, Stolen Device Protection on. And GPUBreach, from earlier, can read AI model weights and post-quantum encryption keys straight out of a graphics card's memory.

Privacy Guides published the Cellebrite leak and Schneier picked it up. The product is called "Advanced Unlocks" and targets phones in the after-first-unlock state, which is the state your phone is in basically all day. The GPU piece is the same paper as above: the card's memory holds whatever you loaded, including LLM weights and cuPQC keys, and the attack reads it.

The connection across all three is that hardware which has to measure its surroundings to work (channel estimation, radios, DRAM cells) leaks those surroundings. Nobody designed it to spy, and it does anyway. Someone on the stream put it well: every old device you own that is no longer receiving updates is now about as secure as your bag in a Paris riot.

The hit: Six remote-management and backup appliances are on the actively-exploited list this week. If you run any of these, it's not a "schedule it" patch.

In the GPU video I said the graphics card is now a front door. This week it's the backup box, the SD-WAN orchestrator and the remote-support appliance. The things you bought to manage the fleet are how the fleet gets managed by someone else.

Chrome 156.0.8078.47 shipped more than 15 CVSS 9.6 fixes in a single release on October 20. That's it. Close this, go to chrome://settings/help, come back.

The hit: I made a 90s mecha anime with Blender and AI this week (sponsored by Flova). The model copies your placeholders exactly, every single one. If you can block a scene, you can direct it. If you can't, it will faithfully render your mistakes.

The lesson that stuck had nothing to do with anime. If you tell the model the blocking image is the authority, it keeps the boxes. The gray boxes I threw into Blender did more work than any prompt I wrote. That's the same lesson as the abliteration caveat. A model that doesn't refuse isn't accurate, and a model that follows your layout isn't creative. Both are literal. Neither is wise. You are still the one who has to know what the picture is supposed to look like.

I was director of engineering at American Express, and I can tell you the state of software at those banking institutions is anything but secure. It's band-aid fixes on band-aid fixes. Given everything above, $50 intrusions, agents that don't sleep, a floor full of 31-year-old bugs that AI is now reading line by line, I expect a US bank to get hit in the next three to six months.

- Dr. J