Governments unplugged their own websites this week over a PHP bug first flagged in 2004. The bug didn’t get smarter. The thing hunting it did. Two weeks ago I wrote All Software is Cooked. No more moats… we must build to survive.
I’ve been spending all week and this weekend shoring up my security. It’s painful. Especially rotating manually security/environment keys and canceling my Railway plan… ugh.
TL;DR on what has happened so far…
PHP2Shell. Two bugs in PHP itself. Germany, France, Belgium, the Netherlands, Finland and Czechia took government sites offline before the patch existed. The UK had 32 services down. Japan’s prime minister tweeted that unplugging was a valid move. Nintendo and Wikimedia pulled systems. All precautionary.
eMudhra, a certificate authority, had eight keys that should each be one of 2^384 possibilities. Scott Helme cracked all eight on a laptop in under a second. One of them was 4. A garage door keypad has 10,000 codes.
Keys are the loot now. Railway paused every deployment after an attacker decrypted customer secrets. LiteLLM shipped a poisoned release that sat on PyPI for two hours. OpenCode lost users’ OpenAI, Anthropic and Google keys, and people woke up to bills in the hundreds. With pay-per-use ai, a leaked key is a credit card with no limit.
Chrome 156: 353 security fixes. A critical one credited to an Anthropic researcher “assisted by Claude,” another to OpenAI’s security team. The labs are finding the browser bugs now…
The Moat Was Boredom - On pHp
Calif’s timeline is the whole story:
2004: Stefan Esser finds the first PHP memory-limit bug.
2020: Bug filed. Treated as a robustness issue.
2024: An audit finds a related flaw. Their words: “exploitation was not proven, so it was not fixed.”
Aug 1, 2026: An agent in OpenAI’s Patch the Planet program finds the trigger. Working exploit by Aug 14. Second bug Aug 21, after the model turned the first one into a reusable skill file. Wiz finds it independently with Gemini.
22 years. Then 2 weeks.
The bug never hid. It cost more human hours to weaponize than anyone would pay. That was the moat. Boredom.
Agents don’t get bored.
Adobe’s moat was decades of code. The PS5’s was a proprietary OS. Every old codebase on the internet had one too. Same mechanism, same month, pointed the other way.
The moats are gone. All old code is now a liability.
The Hunt for Red October is now a daily security-loop you install on several agents burning tokens running around your infra 24/7. Welcome to the new new.
Stay safu. I’m on op/devSec all weekend.
-ps