Everything is hacked! This is fine? 🫠

🚨 PHP has released emergency patches for two critical RCE vulnerabilities. Organizations unable to patch are advised to take affected systems offline. Believe it or not, PHP still runs an enormous amount of the web. And nearly half of #PHP sites run EOL versions.

🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised. Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.

Don't tell Michael Scott the bankruptcy system is down

🎙️ @andrewbecherer on the Build vs Buy decision for security teams in the agentic AI era

Anthropic researchers ran a 26-billion-parameter model across fifteen cheap Android TV boxes 🤯

“It’s never been easier to build a security program. It’s never been harder to secure an organization.” 🗣️ @andrewbecherer & @dannguyenhuu from @DecibelVC

More than 500 GitHub accounts... Tens of thousands of repos... GhostAction is back 🔪

The payload now also scans source code and full git history for cloud and AI credentials, including secrets deleted from current files. It captures nearby lines around AWS key IDs to find the corresponding secret keys. socket.dev/blog/ghostaction-…