Open in CoinFlip OS »

Monday, 26 October 2026 · by Akiba · 12-minute read

Brian Left in 2019

Heads: AI fixes the world | Tails: It doesn’t matter.

TODAY'S COIN: TAILS

The Flip

Each week I will flip a virtual coin with regards to the fate of humanity.

• HEADS - AI helps bring in the dawn of a new age for humanity
• TAILS - We carry on…

The flip of a coin to decide humanity’s fate might sound flippant (pun intended), but it’s far from that. My point is, even if it was a coin flip, I would take those odds.

Last Wednesday PHP shipped fixes for two critical flaws.

If you’ve never heard of it, PHP is a programming language that quietly runs behind a huge share of the world’s websites, WordPress included. Ever read a blog or bought something from a small online shop? There’s a good chance PHP was doing the work in the background…

The two flaws, in the PHP Foundation’s words, let an unauthenticated attacker run code on servers running PHP.

In plain English, a stranger with no password could make a web server run their code.

AI found them first. A researcher at security firm Calif, using OpenAI’s GPT-5.6 Sol, reported one of them on 11 August, through the AI company’s Patch the Planet programme.

The UK’s NCSC and America’s CISA, the two countries’ cyber security agencies, both said to patch now, and to take systems offline if you can’t.

And then suddenly social media (especially Twitter/X) decided the internet was over…

Five days on, here’s what actually happened.

THE BUG WAS REAL

Amazon’s honeypots (decoy servers built to be attacked) caught an exploit attempt on 17 October, four days before anyone was told.

The bug has a nickname now, PHP2Shell, and Amazon’s page says “PHP2Shell is now seeing broad exploitation attempts in the wild”.

Attempts.

It also says it’s unclear whether any of the early ones “would have succeeded in real-world systems”.

THE APOCALYPSE WASN’T

On Thursday afternoon security firm Sophos reported a successful compromise, then corrected itself the same evening: scanning and a few failed attempts, “no evidence of a successful compromise”.

CrowdStrike says a reliable exploit needs an exact match of PHP build and server setup, and it has only seen probing and failed attempts.

And as of CISA’s latest catalogue (23 October), PHP2Shell isn’t on its Known Exploited Vulnerabilities list. That isn’t an all-clear, the list only covers what CISA has confirmed…

BUT THE AGENTS SHOWED UP

On Friday, Unit 42, Palo Alto Networks’ threat research team, updated its threat brief with a PHP2Shell break-in at a government entity in Europe.

Within two hours of getting in, the attackers had password hashes and MFA secrets, had tunnelled into Active Directory and were trying for Domain Admin.

That’s scrambled copies of staff passwords, the secrets behind their two-factor codes, the directory that decides who can log in to what, and a run at the master key to the lot.

Two hours.

The giveaway that AI was involved was in the commands. Each batch was wrapped in markers like ==SHELLUSER== and ==PASSWD==, which Unit 42 says produce “machine-parseable output for an AI model to read”.

Unit 42’s Andy Piazza put it like this: “Still not the widespread outbreak we all braced for, but it’s actively exploited in the wild.”

Meanwhile Dan Guido, who runs security firm Trail of Bits, says “Our PHP exploit is now production-grade”, from stock settings to root (full control of the machine). It isn’t public, and that’s his claim.

The defenders have agents too. AWS says its own security agent exploited 33 of 37 real-world vulnerabilities rebuilt as test targets, on a benchmark it calls “contamination-reduced, not contamination-free”. Contamination is when the test answers may already be in what the AI learned from.

None of this came out of nowhere. The same Wednesday, Microsoft said a China-state-aligned group used an open-source AI agent framework to go from first targeting to privileged cloud access in under three hours, more than once.

CrowdStrike found four new groups running AI agents. And AI security firm Straiker found a criminal crew with four Claude ‘agents’ debating each target before one of them made the call.

Even the criminals’ AI agents have meetings now…

I’m calling last Wednesday Red Wednesday anyway. The internet survived, but the speed once someone is inside has changed. Two hours from a web shell (a hacker’s foothold on a web server) to knocking on Domain Admin is quicker than a lot of teams read their alerts. AI finding the hole first is exactly what I want AI to be doing. The fix is still dull: patch, restart, rotate your secrets…

We’re in this holding pattern where frontier AI is still closed source, or the hardware needed to run them create a similar moat, far surpasses the capability of open-source AI. Open models are now extremely good. I run Qwen Next on my local machine and it can code alongside gpt-6.1 sol no problem.

However, if it goes up against the best version of gpt-6 available to OpenAI insiders and is tasked with finding a vulnerability in a server, it is going to lose every time.

So, now we’re at a point where we NEED big corporate AI to stay ahead in cyber security so that the rest of the world can stay one step ahead of potential hackers through responsible disclosures. That means cyber security experts should be in higher demand as everyone makes updating software a new priority.

I don’t love it. But as long as the big corporations who essentially now hold the fate of the internet in their hands continue to act responsibly and work in the best interests of humanity everything will be great. I mean we can trust them right? /s

Bonus Flip: The AI-Key Heist

TAILS. Old sins, new prize.

While everyone was busy patching PHP that Wednesday, two companies that make tools for software developers, Railway and LiteLLM, were hit by attacks of their own. Both have since published write-ups on what happened, and the attackers at both were after the same thing…

Keys to AI models.

Railway, a cloud platform for developers, says the attackers were “attempting to obtain AI provider API keys to perform distillation attacks”. Translation: using other people’s access to copy a model.

At most 1.85% of Railway’s workspaces, about 100,000, had some secrets potentially exposed. Railway says the attacker “had access to abliterated models and substantial compute resources”. Abliterated means the safety refusals have been stripped out.

LiteLLM, a popular open-source gateway that lets developers plug their apps into lots of different AI models, pushed out a poisoned release (a tampered version of its software) on Wednesday. Its root cause write-up says its own earlier updates were “inaccurate or incomplete”.

Here’s how it happened. On 27 May a config file with a master key was committed to a public code repository. The commit was overwritten, but “key revocation did not occur for the master key”.

On 10 October the attacker used it to grab an owner’s GitHub token, then went hunting “with a primary focus on upstream inference API tokens”.

The release needed sign-off from an account locked to a device in the office… until that was relaxed earlier in the week to any two engineers.

Of all the weeks.

A key nobody revoked and a safety check loosened for speed, the same old mistakes, only now the key opens up someone else’s compute bill and someone else’s model…

If you’ve followed crypto for a while, this will sound familiar. Swap “API key” for “hot wallet key” and it’s the same story, a key left somewhere it shouldn’t be…

Bonus Flip: The Intelligence Curse

TAILS, unless we own a slice.

A post doing the rounds on X says “The Intelligence Curse is happening”.

The argument: when AIs make humans economically useless, governments and corporations lose their reason to invest in people. “For centuries, normal people could withhold their labor to negotiate. That era is almost over.”

Cheery.

Last Monday, CryptoSlate reports, Elon Musk pledged one SpaceX share to every child in America in 2027, roughly $10.5 billion at the 16 October close, and told companies to hand shares straight to the public.

That followed Anthropic’s pledge to put 5% of its shares into a public benefit fund, my Late Flip in Issue #1 last week.

So the two answers to the curse are on the table already. Either your labour stays worth something, or you own a piece of the thing that replaced it. I think the second one is where this is heading, which is basically my ‘capitalism eats itself’ theory from last week. But one share per kid won’t help their parents pay rent. It’s a gesture, sure. But it could be the end game of capitalism. The test is whether these pledges grow as the jobs shrink…

Brian Left in 2019

A post from an IT account on X about the scramble to patch PHP has 3.8 million views.

It might be a bit, it might be real… either way…

Security calls IT at 6:12am: patch every PHP server.

How many do we have? “According to inventory: 12. According to reality: Nobody knows.”

They find one under someone’s desk, two inside vendor appliances, and a server named PHP-OLD-DO-NOT-TOUCH. “Naturally, that one runs payroll exports.”

The PHP 5.6 box belongs, per the documentation, to BRIAN.

“Brian left in 2019.”

They call Brian. “Oh wow, that’s still running?”

The CEO asks why, if hackers don’t need a password, “WE need passwords”. Marketing refuses to take a landing page offline because the webinar campaign is live.

And then suddenly the scanner finds TEMP-PHP-2014. Uptime: 4,512 days.

Temporary.

Block its network access and the warehouse stops printing shipping labels.

The punchline: “The emergency patch took four hours. Finding out what PHP actually runs took eleven.”

LOOK CLOSER

The government advice from NCSC starts with “Identify systems running PHP across your infrastructure”, and warns about appliances and services that bundle PHP inside them.

CISA says PHP “is often a component of other software and prevalence may not be directly observable.”

Translation: nobody knows where all of it is…

Including the people whose job it is to know.

And the timing is frightening. Amazon says AI makes it cheaper to turn a patch into a working exploit, so “more actors can act within hours or even minutes”.

Its advice to security bosses: “A 7-day or 30-day SLA assumes a delay that no longer exists.” That’s the patch deadline most teams set themselves.

So who isn’t laughing?

Whoever inherited Brian’s box and the pandora’s box of outdated, unpatched software it likely now contains. The two-person agency running forty client sites. The small charity whose website was built in 2014 and never touched since.

And the PHP Foundation itself, which says AI tools mean far more reports: 15 CVEs (officially catalogued security flaws) published since 1 July and more than 100 reports that were invalid, duplicates or couldn’t be reproduced.

AI found the bug back in August. Nobody has found Brian.

So if the charity with no IT team can’t find Brian’s box either… who does?

THE LEVER

Nobody’s auditing the whole internet this week. Here’s what you can do:

1. Ask what your website actually runs on, in writing. If you have a site, a shop or a booking page, email whoever hosts it and ask: are we on PHP, and is it 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later? “I think so” isn’t an answer.
2. If it can’t be patched, follow the NCSC order. Temporary mitigations first, offline if that’s too slow, then check for signs someone already got in. Amazon says to investigate from 17 October, not from release day.
3. If your business makes money on PHP, pay the people who fix it. The PHP Foundation says its security work still depends on a small group of funded developers and some volunteers. That’s cheaper than one bad week…

Quick Flips

A few smaller, shorter stories with my quick takes. Remember, if it’s HEADS, we’re heading towards an age of abundance. If it’s TAILS, we’re going the other direction.

1. The US government formally bans Chinese AI lab DeepSeek from civilian agencies. A Homeland Security notice in the Federal Register on Tuesday excludes DeepSeek products and services, and removes “third-party products and services developed using DeepSeek implementations” from civilian agency IT.

TAILS. Fair enough for government systems. The thing is, that second clause is doing a lot of heavy lifting… Does a US product fine-tuned on DeepSeek’s open weights, the model files it gives away for anyone to download, count as DeepSeek?

2. Anthropic’s new agent asks before it acts. Claude Duet is a research preview of a proactive assistant that watches your connected apps and comes to you with what needs attention. Before it sends a message, makes a payment, signs a document or deletes anything, it “shows you exactly what it’s about to do and waits for your approval”. Waitlist only, US users on Claude’s Pro and Max plans first.

HEADS. In the week of LiteLLM, “asks first” is the right default. How long before we all get bored and just start clicking approve? I mean I’ll read the start and end of the command… probably…

3. PyTorch gets a little less tied to Nvidia. Google open-sourced TorchTPU, which runs PyTorch (a hugely popular toolkit for building AI models) natively on its TPU chips, and AWS put TorchNeuron, a native PyTorch backend for its Trainium chips, into public beta.

HEADS. Code that moves between chips with fewer rewrites means more choice and cheaper compute. Quiet, but it chips away at Nvidia’s software moat, the years of AI code written for its chips first… is that moat as deep as everyone thinks?

4. Jack Dorsey’s Block built a voice AI that learned to talk only by listening. Dessa was trained from scratch on human conversation, no text, on a single rack of Nvidia GPUs, and Block says it runs locally on a MacBook Pro M4 Max or better. It talks and listens at the same time, pauses and laughs included. Block, which also builds and funds open-source bitcoin and AI projects, says it needed “hundreds of times fewer words” than LLMs (the text-trained models behind chatbots like ChatGPT), though there are no benchmarks on the page yet. A small group of AI safety researchers gets early access first.

HEADS, with the phone on silent. A human-sounding voice that runs on a laptop is great for the rest of us… and great for scammers. Agree a family safe word this week. Would your mum know it wasn’t you?

5. Is AI conscious? Three careful researchers say slow down. In Nature, Anil Seth, Ned Block and Giulio Tononi give three reasons why today’s AI isn’t conscious, starting with “Consciousness is not the same thing as intelligence”. They warn that giving rights to AI that only seems conscious could hinder oversight “at precisely the time when oversight is urgently needed”. Separately, neuroscientist Doris Tsao’s team posted a preprint on the primate brain flipping between conscious and suppressed states about 15 times a second, and X turned it into proof that consciousness has a frame rate. Tsao replied herself: “We have not shown that ‘consciousness has a frame rate.’”

HEADS, for the clarity. Social media algos want a yes or no and it’s really starting to piss me off. I QT the scientists a few times on this one NGL.

A Better Question

Your feed is asking: “Is this Black October?”

Here’s a list going round on X of everything that broke this month, PHP, LiteLLM, Railway and the rest, as if it were one big outage.

A better question: If an attacker’s AI agent can get from a web shell to Domain Admin attempts in two hours, how many hours does your team take to notice? And were you up to date with every CVE affecting your stack before this week? If not maybe this is just a wake up call.

Everyone’s been talking about patching, but how fast you notice decides how bad it gets.

Unit 42 spotted its case because the commands looked like they were written for a machine to read. Would your team have noticed?

(Not sure what your own website runs on? Ask ChatGPT, Claude, Gemini or Grok how to find out from your hosting dashboard, then ask your host to confirm it in writing.)

Hit reply. I read every answer, even the ones written by a dot (one of ChatGPT’s new always-on AI agents).

From the World

If you’re new, The Town is a little pixel town on a floating gold coin, built in the browser, where each issue’s stories live.

Retro gaming but AI news because why not in a world where AI builds it while you’re rabbit holing youtube videos…

TL;DR - Play the newsletter rather than simply reading it in The Town

Enter the town