This week got called Black October. A lot of what came out wasn’t new though. Some of these attacks had been running for months, this was just the week it all got disclosed at once.
Most of the coverage is about PHP. This post is about the part that matters if your team uses AI coding agents.
What happened
PHP2Shell. Two critical bugs in PHP that let an attacker run code on a server without logging in. They’d been sitting in PHP for over a decade, and they were found using frontier AI. Cloudflare’s CEO said they saw hundreds of thousands of exploit attempts within two hours of the disclosure, and millions since. Trail of Bits said one of their engineers built a working exploit in a day using Codex.
LiteLLM. Version 1.107.0 on PyPI shipped with a credential stealer, and the Docker images were hit too. LiteLLM is in a lot of AI agent stacks, so there’s a decent chance it’s somewhere in yours.
Railway. On October 21, Railway said encrypted environment variables may have been accessed, paused deployments, and told customers to rotate their secrets.
Why agents make this worse
Coding agents run pip install, read .env files, and pull in whatever they need to get the task done. Usually nobody is watching while it happens. If a poisoned package or a leaked key is in the mix, the agent isn’t going to stop and ask you about it.
That doesn’t mean stop using agents. I use them every day. It means you should be able to answer what they installed and what they touched.
What to check this week
- Search your lockfiles, images and environments for litellm 1.107.0. If you find it, assume any credential that machine could reach is exposed, and rotate it.
- If you’re on Railway, rotate your secrets.
- Update PHP to the latest patch release for your branch.
- Look back at what your agents installed and read over the last few weeks. If you can’t answer that, that’s worth fixing before the next one of these.
Where Guard fits
This is a big part of why I’m building Guard, a Claude Code hook that checks the commands, file reads and MCP calls your agent makes against a set of rules, and logs what it actually did. There’s a free tier if you want to try it.