A shell of a week: PHP2Shell cracks 70% of the web

Trust infrastructure cracked twice over the past week. eMudhra's certificate-authority private keys turned out to be single-byte numbers — 4, 56, 115 — recoverable in milliseconds from public certificates, and Wiz's PHP2Shell turned decade-old PHP memory bugs into pre-auth remote code execution on ~70% of websites. The software supply chain took its own hits: a compromised LiteLLM 1.107.0 on PyPI stole credentials from every Python process, Railway disclosed access to customer environment variables, and OpenCode told users their credentials had leaked. The same AI that lowers the cost of building such exploits also ran the other direction — Anthropic had Claude write formal proofs for 123 libraries, and DeepSeek, Kimi, and Anthropic all shipped models.

News

Wiz's PHP2Shell research found memory-safety bugs in PHP's core — two CVEs (CVE-2026-109618/109619, CVSS 9.2) enabling unauthenticated RCE and memory disclosure in every PHP version since 5.4, demonstrated against WordPress, Drupal, and Joomla; PHP patched them on Oct 21. Wiz credited Gemini 4 Argon and GPT-5.6 Sol with turning decade-old use-after-free bugs into working exploits, though Elias Taylor notes no public PoC works against a vanilla install — thousands of fakes lean on a pre-existing LFI.

eMudhra's CA private keys were single-byte numbers — 4, 56, 115, and five others on the P-384 curve — that anyone could brute-force from their public certificates in milliseconds; Scott Helme recovered all eight on his laptop. Browsers blocked the intermediates within days, but curl, Python, Node, and Go still trust them by default, and eMudhra is exiting the global SSL/TLS business entirely.

LiteLLM 1.107.0 on PyPI shipped a credential stealer and RCE backdoor in all seven wheels: a cook.pth file ran cook.py in every Python process, exfiltrating SSH keys, cloud credentials, browser passwords, and AI tool tokens to a lookalike domain; the attacker used three developers' stolen GitHub credentials to hijack the release pipeline. Railway disclosed that a third party may have accessed encrypted customer environment variables as part of attacks targeting AI inference providers, and OpenCode told users credentials had leaked.

Quad9 is leaving France on Nov 24 after a French court sided with broadcaster beIN and ordered it to block piracy domains at the DNS level. Quad9 calls recursive resolution a neutral service, says it can't geo-block without keeping user dossiers, and cites ~20 more blocking lawsuits pending.

DeepSeek V4.1 Flash 1017 (MIT, 763B) landed with large jumps across reasoning, coding, and agentic benchmarks, and DeepInfer, the Apache-2.0 inference engine behind DeepSeek's production services, was open-sourced. Kimi K3.1 Pro (1M context) scored 65.7% on Terminal-Bench 4.0 — ahead of GPT-6 Astra — and Moonshot removed cyber-related training data, cutting its exploit-benchmark score from 90.5% to 81%. Claude Duet, Anthropic's proactive background agent running on Opus 5.5, entered a US waitlist.

Articles

Anthropic's formal-verification work had Claude prove no-crash properties for 239 fuzz-test entry points across 123 OSS-Fuzz libraries — at RISC-V assembly level, ~180M lines of Rocq proofs — and the process surfaced bugs fuzzing missed, including a rediscovery of CVE-2026-56132 in libexpat.

Hybrid Reasoning Agents (Stanford/UIUC/Together) interleave latent-space thinking with text for tool calls; the 4B–14B HybridAgents beat matched text and latent baselines by 10.4% on 11 benchmarks while using 35–55% fewer tokens and running 1.8–2.6× faster.

Docker is weird walks through building a container runtime: containers are five kernel features in a trenchcoat, images are folders plus chroot, and runc is written in Go that re-execs /proc/self/exe to approximate fork.

Firefox Local Mode (Firefox 153) maps local folders to custom https:// origins while DevTools is open, so you can test Secure-Context-only Web APIs without spinning up a local server.

Redact found 102 hidden blocks in WhatsApp's help pages, invisible on screen but read by its support chatbot, instructing it not to recommend a data-protection regulator or cite GDPR; WhatsApp removed them on Oct 18 after WIRED's coverage.

Tools

Pele renders Mermaid syntax to themeable SVG with zero dependencies — 230KB gzipped versus Mermaid's 1.6MB and up to 500× faster. (TypeScript)

DuckDB 2.0.0 LTS ("Cinnamon Teal") adds the Quack client-server protocol, asynchronous I/O, a first-class VARIANT type, triggers, and a new PEG-based SQL parser, from ~20,000 commits. (C++)

OpenShell (NVIDIA, Apache-2.0) is a runtime for fleets of AI agents that enforces filesystem, syscall, and network policy at the kernel level and formally verifies policy changes before they apply. (Go/Rust)

DeepSeek Search & Fetch exposes raw JSON web-search and page-fetch endpoints for agents and RAG, billed at $0.75 per 1,000 successful requests. (API)

tsrs is Cloudflare, VoidZero, and Owner.com's Rust port of the TypeScript compiler, up to 8× faster and ~70% less memory than TypeScript 7.0 — installable now as npx tsrs. (Rust)

Worth a Look

Local Wikipedia is Wikipedia filtered to geocoded pages within a half-hour walk of you.

ns2jb is the first software-only Switch 2 jailbreak — a tethered exploit chaining a SmileBASIC integer overflow and an fs sysmodule path-normalization bug, with Codex driving parts of the work and modding Mario Kart World to prove it.

WorldTUI is a 360M-parameter model fine-tuned to be a terminal: no shell behind it, just keypresses in and predicted screen rows out, running at 208MB in a browser tab.

Calif demoed hacking the iPhone at Hexacon — a Signal one-click, an iMessage exploit, and an "Apple Persistent Threat" persistence chain — with full releases promised later.