Colby

Crypto hacks in 2026 are already 71% above the 2022–25 annual average, per DefiLlama. AI helps attackers find bugs faster, and defenders need the same edge to fix them. At @summit_defi in Mumbai, @nisedo is sharing lessons from our AI auditing work, including Patch the Planet.

We achieved RCE via Brotli in Linux labs: • Node.js 24.22.0 + Express 5.3.0 (x86-64/ARM64) through its standard JSON parser • Electron 41.10.7 (x86-64) using a custom-built decoding service Getting it to work requires a carefully matched setup and can take repeated attempts.

Our demo shows PHP2Shell giving a shell on MediaWiki, Symfony, Laravel, and phpBB. We’ve confirmed exploits work on pre-patch releases of PHP 8.2–8.5. If you haven’t updated, assume attackers can compromise your server, and that exploitation will only get easier.

We’re still testing how exploitable the Node.js/Brotli bug is, but we’ve found that it’s surprisingly hard to tell whether you’re even affected. So @ToBScottA built a scanner that finds hidden copies of the decoder, even in stripped binaries. github.com/trailofbits/brotl…

“You want to find the bugs, but it’s only good if you can also fix them.”—@anishrnaik on Risky Biz. Many open-source projects have only a handful of maintainers, and fixes are falling behind. We’re building a reusable toolkit to help. Full pod: youtube.com/watch?v=6SIgPjQ9…

Yesterday, rumors started circulating about two unpatched critical-severity bugs in PHP. Within 17 hours, Cloudflare was blocking attacks and Patchstack reported active exploitation. When AI can develop a working exploit in hours, bugs need to be patched just as fast. Each day without a fix carries the risk that an attacker will find and exploit the bug. But it takes time to create a working patch, and PHP's patch was more complex than most. The patch changed 402 files and added more than 11,000 lines, reworking core engine behavior that dozens of extensions depended on. The bug was reported on Aug 11, and fixes were shipped 71 days later. But less than a day after details leaked, systems running PHP were already under attack. Patching needs to keep up with the pace of bug discovery. For the past four months, we’ve worked directly with open-source projects as part of Patch the Planet to understand how AI can expedite patching. Our ongoing research and work show that project-specific documentation, skills, and plugins can be embedded at the repo level to give agents and contributors access to the context maintainers carry in their heads: what counts as a bug, how a fix should look, and what can't break. Our two new open-source plugins, patching-bugs and regression-hunt, are a first step toward a generalized set of tools and guidance for getting a working patch out faster: blog.trailofbits.com/2026/10… PHP’s account of the incident: thephp.foundation/blog/2026/…