A Day of Unprecedented Software Hacks: CVEs, Attacks, and the Rise of AI-Driven Exploits

Multiple widely used open-source projects and services, including Node.js, GitLab, PHP, Railway, OpenCode, and LiteLLM, experienced security incidents on a single day. Theo from t3.gg described this as "one of the most unprecedented days in the history of software in terms of how many things just got destroyed." He indicated that he had previously warned about the increased risks in the era of Large Language Models (LLMs).

Theo distinguished between two types of security incidents occurring simultaneously: CVEs (Common Vulnerabilities and Exposures) and actual attacks. Projects like Node.js, GitLab, PHP, Quick, and LiteLLM were categorized under CVEs, representing disclosed vulnerabilities that could be exploited. In contrast, incidents involving Railway and OpenCode were identified as actual attacks, indicating active exploitation rather than just potential vulnerabilities.

Theo expressed greater concern about the actual attacks, despite public and media attention often focusing more on the CVE side. He stated that the impact of the PHP vulnerabilities would be discussed in detail later in the video.

Theo highlighted a contradiction in the current software landscape: AI models from companies like Anthropic and OpenAI make it easier to build complex software, but these same tools often refuse to assist with security-related fixes. This creates a challenging environment where developing new software is simpler, yet addressing its vulnerabilities becomes more difficult.

He then introduced Code Rabbit's security tooling, a sponsor of the video, as a potential solution. Code Rabbit reportedly utilizes a combination of models, selecting the best-approved ones for specific tasks and other models for the rest, to provide necessary security feedback. Their platform includes a security dashboard to track issues, and their code review process integrates security reviews for every pull request. A 'deep scan' feature can analyze entire repositories to identify potential security issues, mapping them to known vulnerabilities, and even offers a one-click fix option.

During the filming of the video, Oracle reportedly experienced a security incident. Theo classified this as a CVE (vulnerability disclosure) rather than an active attack.

Theo reclassified the LiteLLM incident, removing it from the list of CVEs (codebase vulnerabilities). He explained that the issue was not a bug within the LiteLLM codebase itself, but rather a hijacking of GitHub Actions. This allowed a malicious malware version to be published alongside the legitimate LiteLLM.

The speaker decided to remove LiteLLM from the CVE discussion because it didn't fit the scope of codebase bugs, focusing instead on vulnerabilities and active attacks. He reiterated that the "attack side" of security incidents is more interesting and important, but would first cover the CVEs, which are common vulnerabilities tracked by a government-funded program to identify, assess, and address software security issues.

A critical security flaw was exposed where a company with the authority to issue SSL certificates had its private key set to the trivial value of "four." Theo emphasized that while four is a random number, it is not an effective password, making the key extremely vulnerable. This weak key was not only existing but was actively being abused.

As a result, any system that honors certificates issued by this authority is compromised. Users are urged to update their browsers immediately, and all certificates issued under this compromised key should no longer be considered valid. This incident underscores the importance of strong security practices, even at the fundamental level of key management.

Theo explained that when a fix for a vulnerability is released, there's a dangerous 'vulnerable window' between the code shipping publicly and users updating their software. Historically, exploiting this window required significant effort to find, understand, and distribute exploits. However, the vast majority of current exploits occur on known, fixed vulnerabilities because users haven't applied the updates. This highlights the critical need for users to stay on the latest versions of their operating systems, applications, browsers, and dependencies.

AI agents are fundamentally changing the landscape of software security by collapsing the cost of finding and exploiting patches. These agents can meticulously review every commit, identifying security-related changes, meaning that the obviousness of a fix no longer provides protection. Models can analyze simple commits, even those not explicitly labeled as security fixes, and then trivially generate methods to exploit older software versions.

Theo pointed out that frontier AI labs are often willing to generate demo exploits when asked, for example, to create a demonstration of how to exploit a recently merged security fix for a class. Open-weight models are almost certainly capable of complying with such requests. This development means that the primary remaining factors in exploit success are how quickly patches are deployed and the extent of access the exploit grants to attackers.

The severity of an exploit is now paramount, as exemplified by the FBI tweeting about the PHP exploit. This particular vulnerability, classified as a CVE, could allow malicious cyber actors to remotely execute code in PHP Core, potentially compromising sensitive data and networks. The FBI urged organizations to immediately update affected PHP installations or, if not feasible, take systems offline until mitigation is complete. They also recommended inventorying PHP installations, prioritizing internet-facing systems, and monitoring web servers for suspicious activity, such as PHP processes unexpectedly launching command shells.

Both critical PHP CVEs (Common Vulnerabilities and Exposures) are rated 9.2 out of 10 on the severity scale. The exploit enabled by these vulnerabilities is colloquially known as "PHP to shell." This is a memory exploit that grants attackers root access to affected systems.

Theo highlighted the severity of these exploits, noting that the FBI issued a warning about them. The FBI urged organizations to immediately update affected PHP installations, inventory all PHP environments, prioritize internet-facing systems, and monitor web servers for suspicious activities like PHP processes launching command shells or downloading files. They also provide a government site for reporting potential exploitation.

A significant contributing factor to the severity of this exploit was a breach of a coordinated security embargo. According to the PHP Foundation, Chainguard released patched PHP container images hours ahead of the scheduled public release. This premature disclosure allowed attackers to study the fixes before other distributors could prepare and deploy their updates, effectively giving them a head start in developing exploits during the vulnerable window.

A critical factor making the PHP exploit particularly dangerous was a breach of the security embargo. The PHP Foundation reported that Chainguard broke a coordinated security embargo by releasing patched PHP container images hours before the planned schedule. This action made the fix available for attackers to analyze while other distributors were still preparing their updates.

Theo emphasized that as soon as any evidence of an exploit exists, AI agents can take advantage of it incredibly quickly. Therefore, it is paramount to have a rapid update path ready when vulnerability information becomes public. Early knowledge of a fix without widespread deployment means that systems remain vulnerable for longer. Additionally, Theo noted that the PHP exploits were found using GPT 5.6 Soul, demonstrating that even less advanced models can discover such vulnerabilities, and independent groups are often finding these issues simultaneously.

Theo clarified that the real issue isn't simply 'dead websites' that no longer exist, but rather neglected ones that are still running without proper maintenance. He cited examples like websites built by individuals who have since left their jobs, or random government sites that are no longer updated. These unmaintained sites, often powered by systems like WordPress, which is itself described as more fragile than PHP, become prime targets for exploitation. He shared a personal anecdote of a WordPress site he built for his uncle in high school, which was later compromised due to neglect.

Theo challenged the common claim that PHP powers an estimated 70% of websites, asserting that the vast majority of websites receiving actual traffic today do not use PHP. He urged viewers not to be overly concerned by the "70% numbers" because they often include unmaintained or defunct sites that receive no traffic.

Transitioning from CVEs to actual attacks, Theo then discussed the OpenCode hack. In this incident, OpenCode's own API keys were rolled, but any API keys from services like Anthropic, OpenAI, or Gemini that users brought to OpenCode's dashboard or server-side were compromised. Many developers reported their OpenAI and Anthropic API keys were consumed, leading to account suspensions and unauthorized spending ranging from hundreds to thousands of dollars within minutes. OpenCode has been working with labs to issue refunds, reinstate accounts, and automatically roll compromised keys.

Railway, a deployment platform, experienced an attack similar to OpenCode's, with its systems storing customer environment variables detecting anomalous activity. An unauthorized third party may have accessed encrypted environment variables and obtained their decrypted contents for some users. These environment variables often contain sensitive information such as API keys or database and registry credentials.

Theo expressed frustration, noting that all his deployments on Railway were down. This was not only due to compromised environment variables but also because Railway took down deployments, preventing him from redeploying with new variables after rolling them. At the time of filming, deployments had been down for 16 hours since 1 a.m. This deployment outage was stated to be unrelated to the hack itself but rather a separate issue with Railway's operations.

Theo asserted that the sole reason for stealing API keys that grant access to frontier AI models is 'distillation.' He dismissed common speculation that stolen keys are used for scams or crypto-related activities, arguing that cheap open-weight models suffice for generated replies in scams, making it illogical to burn expensive, quickly revoked API keys for such purposes.

He explained that an API key offering unlimited usage for a short period is less valuable than one with daily limits over a longer term, as consuming millions of dollars in inference in a single day is practically impossible for most users before the key is revoked. The true value lies with AI labs that aim to train new, capable models. These labs, such as a hypothetical company named SEDDeek, seek to use the best available tools, like Claude from Anthropic or models from OpenAI, to generate data that can be used for training their own models.

Theo explained that the data used to train AI models is becoming harder to acquire because the internet is increasingly "locked down." Furthermore, traditional internet data is less valuable for training AI agents, particularly for tasks like coding within a bash terminal, as there are few examples online of how agents solve such problems. This scarcity means that this crucial data must be "manufactured" by running existing models.

This is why many companies actively collect user history from interactions with models like Claude and OpenAI: to refine and train new models with similar capabilities. This practice enables other AI labs, those not affiliated with Anthropic or OpenAI, to catch up faster by leveraging this generated data without needing to build the extensive systems and environments that initially produced it. The demand for this type of data, which shows how LLMs handle complex tasks using their tools, makes frontier model outputs incredibly valuable for distillation.

AI labs cannot simply purchase tokens for distillation because leading providers like Anthropic actively ban accounts engaged in such activities. Anthropic has specifically blocked attempts by Chinese labs to collect enough data for distillation. They even temporarily banned US-based Windsurf due to concerns that OpenAI might acquire them and use their data. Anthropic has also cut off some South Korean companies, including investors, over suspicions that Chinese labs were using their API keys for distillation.

While Anthropic states safety as its reason for these bans, Theo believes it also serves to protect their monopoly. This creates a high demand for Anthropic and OpenAI API keys in sketchy black markets, as many companies are willing to pay significant amounts to generate tokens for training their own models but are unable to purchase them legitimately.

Anthropic employs a range of strict measures that significantly hinder access to its API, particularly for developers in certain regions. These measures include thresholds on API usage and account age, with some advanced features only accessible to older accounts. Crucially, Anthropic enforces hard bans on specific IP addresses and regions, such as China, making it exceptionally difficult for individuals or labs in those areas to register for and use their inference services.

Theo emphasized that a Chinese lab, for example, cannot simply register a cloud account and expect to have easy access to Anthropic's services. These restrictions create an opportunity for hackers and dishonest individuals to exploit unmonitored API keys from legitimate users. With a stolen API key, these malicious actors can generate a large volume of tokens for distillation purposes, using someone else's billing information and account before the keys are inevitably banned.

Theo explained that Anthropic's unwillingness to sell inference to companies seeking tokens for distillation has created a "weird downstream effect," turning users and platforms like Railway and OpenCode into unprecedented targets. He noted that while compromising Railway historically offered limited value, in the AI era, stealing API keys stored on deployments is highly lucrative.

Previously, obtaining a full database dump might yield little useful data before being locked out, but a stolen API key, capable of generating hundreds to thousands of dollars in value before revocation, is easily resold on black markets. This high demand for Anthropic and OpenAI API keys means that "every platform that hosts API keys is a target now." Theo sarcastically commented that Gemini is not currently a target for distillation, "even Google."

He expressed a grim outlook, suggesting that the situation is likely to worsen before it improves. He views Anthropic's stance as contributing to this "hellish side effect," where legitimate entities are caught in the crossfire due to the black market demand for these keys. Additionally, he noted the irony that AI models from Anthropic and OpenAI cannot be used to help fix these security issues, as they might refuse due to suspicion that the user could be the hacker.

Theo vehemently denied any connection between the PHP hack and the security breaches affecting Railway and OpenCode. He stated that it is "so very obvious these things have nothing to do with each other" and suggested that anyone who believes otherwise might struggle in the software development field. He urged viewers to protect their software, keep everything updated, monitor online security news, and ensure API keys are well-protected, separated, and easy to revoke, anticipating that the situation will worsen before it improves.