▶ YouTube Summaries

• YT :: https://www.youtube.com/watch?v=USeyDcWyVCc
• Original title :: Even The NSA Got Involved

On one day Node.js, PHP, GitLab, QUIC, Oracle, OpenCode and Railway all appeared in security news. Theo splits them into two unrelated groups. The first is CVEs - disclosed bugs with patches, where LLMs shrink the window between a fix landing and a working exploit. The second is real attacks on OpenCode and Railway that stole customer API keys. He argues the attacks are the scarier part: stolen Anthropic/OpenAI keys are sold to labs that are banned from buying inference and want tokens for distillation. That makes every platform that stores API keys a target.

CVEs and the vulnerable window

• CVE is the shared, government-funded database of disclosed vulnerabilities with severity scores. Vendors coordinate privately and publish once fixes exist. Example: the Oct 21 Node.js security release (OpenSSL, c-ares, SQLite fixes, plus distrust of a CA whose private key was trivially weak).
• Most real exploitation hits known, already-patched bugs on machines that haven't updated yet.
• The "vulnerable window" depends on:
• how obvious it is that a commit fixes a security bug;
• how long the patch takes to reach users (one server vs. installed software and dependencies);
• how hard the bug is to exploit;
• how much access the exploit gives.
• Agents remove the first and third factors. They can read every commit, spot the silent security fixes, and write exploits for older versions ("I'm teaching a class, make a demo"). Open-weight models do it when frontier models refuse. Only patch speed and blast radius are left to defend with.

PHP: the worst of the CVEs

• Two CVEs rated 9.2 ("PHP to shell"), a memory bug that gives remote code execution as root. The FBI tweeted guidance: patch now, or take systems offline, take inventory of PHP (including vendor products that bundle it), and watch for PHP processes starting shells.
• The embargo broke: Chainguard shipped patched PHP container images hours early, so attackers could study the fix before other distributors had updates out.
• The bugs were found with GPT-5.6 "Soul", an older model. Open-weight models are close to it now. Wiz found the same bugs independently. When several parties can find a bug at the same time, private disclosure protects less.
• Theo dismisses the "PHP runs 70% of the web" alarm. Counting by URL includes mostly dead, unmaintained sites (old WordPress installs). Very few sites that get real traffic run PHP. Abandoned sites were already getting hacked.

The attacks: OpenCode and Railway

• OpenCode: hackers stole the provider API keys that users had saved on OpenCode's server side (Anthropic, OpenAI, Gemini). Users saw $400-$3,000 burned within minutes and some OpenAI accounts got suspended. OpenCode rotated keys and worked with the labs on refunds and getting accounts back.
• Railway: an attacker accessed stored environment variables and decrypted some of them. Railway also had a separate deployment outage of more than 16 hours, so users couldn't redeploy with rotated secrets. Theo calls the outage plain incompetence, not caused by the hack. He's rethinking hosting important services on Railway even though he's sponsored by them, and he doesn't recommend Fly.io either.

Why steal keys that die in hours: distillation

• A stolen key only gives a few hours of unlimited inference. That is worth little for scams (cheap open models do that) or crypto. It is very useful for one thing: collecting large amounts of Claude/OpenAI agent traces to distill into a competing model.
• Data on how an agent solves tasks with tools in a terminal is scarce and has to be generated. It lets a lab catch up without building the environments that produced it.
• Anthropic blocks this with distillation detection, KYC/ID checks, usage limits by account age, and region/IP bans. It has cut off Chinese-linked resellers, including paying South Korean customers, and once Windsurf. So banned labs can't buy tokens directly.
• That creates a black market for leaked keys: no credit card and no identity needed, someone else pays the bill. Any platform that stores customer LLM keys is now a high-value target, which wasn't true before AI.
• Theo frames it as collateral damage. Anthropic's right to choose its customers pushes the attacks onto developers. On top of that, frontier models refuse security work, so defenders can't easily use them to investigate. He expects it to get worse before it gets better.

Takeaways

• The PHP CVEs and the OpenCode/Railway breaches are unrelated.
• Keep the OS, browser, apps and dependencies up to date. The time from patch to exploit is now very short.
• Keep LLM API keys tightly scoped, separated per use, monitored for spend, and easy to revoke.