AI-powered PHP exploits and a malicious PyPI release

In this issue

eMudhra’s weak certificate keys exposed
Wiz Research uncovers critical PHP vulnerabilities using AI
LiteLLM 1.107.0 PyPI release contained credential stealer and backdoor
Hirundo removes CCP alignment from Qwen3-Coder to fix security bias
DuckDB 2.0.0 LTS introduces Quack protocol and VARIANT type
Anthropic previews Claude's ability to reduce code attack surfaces
and 4 more in brief

Top stories

eMudhra’s weak certificate keys exposed

Security researcher Scott Helme revealed that eight eMudhra intermediate certificate private keys were trivially recoverable. The keys were single-byte values, such as 4, 56, and 115, rather than the expected 384-bit random numbers. Helme recovered all eight keys in under a second by brute-forcing the public certificates. Because the keys were effectively public from their creation in April 2025, anyone could have compromised them. Mozilla shipped an update removing the eMudhra root, while Chrome confirmed the root is going in Chrome Root Store v43.

scotthelme.co.uk HN discussion

Wiz Research uncovers critical PHP vulnerabilities using AI

Wiz Research identified multiple critical flaws in the core PHP engine, enabling unauthenticated remote code execution and memory disclosure. These vulnerabilities affect nearly every PHP version released in the last decade, including releases dating back to PHP 5.4. The underlying bugs had existed for decades, but demonstrating their exploitability required an exceptionally complex chain of steps. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into a practical exploit. PHP released a patch fixing these memory-safety vulnerabilities on October 21, 2026. Immediate patching is strongly advised to prevent attackers from taking control of affected servers or stealing sensitive data.

wiz.io HN discussion

LiteLLM 1.107.0 PyPI release contained credential stealer and backdoor

The LiteLLM 1.107.0 release on PyPI included a credential stealer and a backdoor that executed on every Python start. All seven wheels installed three malicious files, including a .pth loader and a sitecustomize.py daemon. The stealer collected SSH keys, cloud credentials, and browser passwords, while the daemon fetched remote code hourly. The upstream GitHub source did not contain these files, and PyPI has since removed the release. Versions 1.106.2 and the 1.107.0 release candidates remain clean.

safedep.io HN discussion

Hirundo removes CCP alignment from Qwen3-Coder to fix security bias

Hirundo published a case study showing that Alibaba's Qwen3-Coder generates less secure code when prompted for US or Hong Kong customers. The researchers traced this vulnerability to the model's weights and demonstrated that removing CCP alignment via behavioral unlearning eliminates the bias. In their tests, the original model was 19% more likely to produce hackable apps for US defense contractors compared to Chinese ones. After modification, the Westernized model closed these security gaps while maintaining comparable performance on other coding tasks.

hirundo.io HN discussion

DuckDB 2.0.0 LTS introduces Quack protocol and VARIANT type

The DuckDB team released version 2.0.0 LTS, codenamed “Cinnamon Teal,” marking its largest feature update to date. The release includes a polished Quack protocol for client-server setups, asynchronous I/O, and a first-class VARIANT type. It also adds agent mode, triggers, and an extensible SQL parser. Built from nearly 20,000 commits since version 1.5, this LTS release is supported until at least October 2027. The team notes that while core clients are available, some language bindings and extensions may take a few days to release.

duckdb.org HN discussion

Anthropic previews Claude's ability to reduce code attack surfaces

Anthropic shares initial data on using Claude to map and restrict unnecessary code reachability. The company argues that reducing attack surfaces improves security more effectively than fixing individual vulnerabilities, as it lowers the severity of unknown flaws. In tests across 25 open-source projects, Claude identified 493 issues, including cases where configuration conflicts silently disabled security controls. Anthropic notes that while these techniques do not remove vulnerabilities, they make them harder to exploit, offering a practical path for developers to enhance software security without exhaustive manual audits.

anthropic.com HN discussion

In brief

Railway reports unauthorized access to customer environment variables. Railway detected anomalous activity affecting systems that store customer environment variables. The company states that an unauthorized third party may have accessed encrypted variables and obtained decrypted contents for some. Railway has paused all deployments while it investigates the incident.

blog.railway.com HN discussion

GitLab releases critical patches for seven supported versions. GitLab released versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 on October 21, 2026. The updates include important bug and security fixes, and GitLab strongly recommends that all self-managed installations upgrade immediately.

docs.gitlab.com HN discussion

QPACK header compression enables memory amplification attacks on HTTP/3 servers. A remote, unauthenticated client can force HTTP/3 servers to allocate significantly more memory than the incoming data size. This occurs because QPACK decodes compressed headers into large objects, and many implementations lack proper limits on the decoded size. Seven of ten tested implementations are vulnerable to this resource exhaustion.

foxio.io HN discussion

Mattia explains creating non-extractable SSH keys on macOS Secure Enclave. Nicolas Mattia describes a method to create SSH keys on a Mac's Secure Enclave using Touch ID. He notes these non-extractable identities prevent key theft and eliminate file-based key management, though the process relies on poorly documented Apple tools.

nmattia.com HN discussion