Two of the most-used pieces of the modern web, PHP and the Python plumbing that routes LLM calls, spent Wednesday on opposite sides of the same lesson. AI is now good enough at finding old bugs that the defenders’ window to fix them is the interesting variable. And the things that connect AI to everything else are now worth stealing from.
Start with the good news that doesn’t feel like good news. Researchers working with OpenAI’s “Patch the Planet” effort, and separately the team at Google’s Wiz, used frontier models to find two critical remote-code-execution flaws in PHP, reportedly present in every version since PHP 5 in 2004. Patches shipped on Wednesday as 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and by the companies’ accounts nobody exploited the bugs in the wild first. The PHP Foundation’s own write-up is candid that one of these fixes had stalled since a 2024 audit over compatibility trade-offs and thin staffing, and that CVE IDs leaked early. The uncomfortable arithmetic: a model that finds a bug in an afternoon also helps an attacker adapt a published patch into exploits for the many sites running older versions. The NSA’s advice, reportedly, is to take unpatchable sites offline. Defense found it first. Now it’s a race against everyone who can read a diff.
The keys are the target
The other half of the day is less hopeful. SafeDep’s analysis of the poisoned LiteLLM 1.107.0 release is worth reading in full. Seven wheels went to PyPI carrying a stealer that ran on every Python start, even if you never imported the library, and swept up SSH keys, cloud and CI credentials, and LLM provider keys, plus an hourly backdoor. The attacker reportedly got in with GitHub CLI credentials belonging to three maintainers, bypassed branch protection and pointed the release workflow at a lookalike repository. PyPI pulled the release within about two hours of upload; container images carried it for longer. If you pinned to anything but 1.106.2 or the listed release candidates, check for cook.pth in site-packages.
The same day, Railway disclosed that decrypted customer environment variables may have been read, described it as part of a broader campaign to reach AI inference providers, and paused all deployments. Two incidents don’t prove a coordinated campaign, and both companies are still investigating. But the shape is consistent: an AI gateway or a deployment platform is a place where dozens of expensive keys sit in one spot, which makes it a better target than any single customer.
Money, undeterred
Meanwhile the capital markets are not blinking. DeepSeek reportedly raised about $15 billion per Bloomberg, with CATL and Tencent among possible investors, just two days after Washington ordered civilian agencies to remove its technology. The restriction bars a federal customer, not a funding round, which says something about where DeepSeek expects its growth to come from. The figures are unconfirmed and the company didn’t comment.
Lastly, a small counterweight to the big-capital story: Recursive’s Flint, a 40B-parameter mixture-of-experts coding model that activates only 2.5B parameters per token, runs at roughly 131 tokens per second on an M4 Pro MacBook, and ships under Apache 2.0. The company says its automated research system handled nearly every stage of development, from pretraining to kernels. That claim is the company’s own, and it didn’t say how much time the system saved, so treat the “built by AI” line as a hypothesis. The laptop-sized benchmark results are the part you can check yourself.
