Skip to main content

PHP2Shell fallout, a PingCAP breach and AI's new fault lines

  1. Security

    PHP2Shell: two critical PHP bugs pushed banks, hospitals and agencies offline (opens in a new tab)

    TechCrunch says Amazon spotted PHP2Shell attacks about a week before patches shipped, and Palo Alto Networks and Trail of Bits now report confirmed compromises. Patch to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and restart every PHP worker.

    Source: TechCrunch

  2. Security

    PingCAP confirms theft of TiDB Cloud source code and customer records (opens in a new tab)

    Attackers used stolen service-account credentials to copy source code, user emails, SQL editor history and encrypted API key values from PingCAP between September 9 and October 7. PingCAP advises TiDB Cloud customers to replace active management API keys and watch for targeted phishing.

    Source: InfoQ

  3. Security

    Nepal keeps thousands of government and bank sites offline over PHP2Shell (opens in a new tab)

    Nepal's software operations centre says most government sites share one platform, GIWIMS, now being audited, with a return expected Sunday to Tuesday. Some systems still run PHP 8.1 or older, which gets no official fix, so upgrading beats workarounds.

    Source: The Kathmandu Post

  4. Dev Tools

    Google makes its open-source Data Agent Kit generally available (opens in a new tab)

    The free kit adds 37 open-source skills and MCP tools linking coding agents like Claude Code, Codex and Cursor to more than fifteen Google Data Cloud services. Its key lesson: safety skills are only advice, so block risky write tools with IAM deny policies.

    Source: InfoQ

  5. Regulation

    Countries are being pushed to choose between US and Chinese AI blocs (opens in a new tab)

    The US State Department says nations cannot be trusted Pax Silica partners while engaging with China's new WAICO group, yet Kazakhstan and Indonesia are trying to join both. Where you deploy may soon decide which chips and models you can use.

    Source: Associated Press

  6. AI

    Block shows Dessa, a full-duplex voice model that runs on a MacBook (opens in a new tab)

    Block's research lab says Dessa was trained only on human speech and can listen while it talks, running locally on an M4 Max laptop. There is no public access yet, and Block is asking safety researchers to test it first.

    Source: TechCrunch

My take

This week proved that the slowest part of security is not finding bugs but knowing where your software runs. The teams that bounced back fastest from PHP2Shell had an up-to-date inventory and supported runtimes, while the systems still offline in Nepal did not, and PingCAP shows one leaked service account can undo everything else. With AI speeding up bug discovery and agents getting direct access to data, treat asset inventory, credential hygiene and hard IAM limits as product work, not chores.