Even The NSA Got Involved
Source: YouTube · Theo - t3․gg · published Oct 22, 2026 · 29:25
A single day saw CVEs disclosed in PHP, Node.js, GitLab, Oracle, and more, alongside real attacks on OpenCode and Railway that stole customer API keys—the speaker argues stolen API keys are now the real prize 0:00.
Key Takeaways:
• Legitimate CVE disclosures (PHP, Node, GitLab, Oracle) hit the same day as actual attacks (OpenCode, Railway) that compromised customer secrets—the attacks are the bigger threat 0:37
• PHP vulnerabilities (CVE 9.2) enable "PHP to shell" root access; the FBI urged organizations to update or take systems offline 9:08
• LLM agents have collapsed the "vulnerable window"—even weak models like GPT 5.6 Soul can find security patches in public diffs and generate exploits before users update 7:17
• The OpenCode/Railway attacks exposed customers' own API keys, with hundreds to thousands of dollars of unauthorized usage in minutes; the motive is likely distillation—banned labs have huge black-market demand for frontier-model keys, making every platform hosting API keys a target 15:27
This will get worse before it improves: keep software updated and ensure API keys are protected, separated, and revocable. The PHP CVEs and the Railway/OpenCode attacks are unrelated despite coincidental timing.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
PHP poned Node.js poned light LLM poned GitLab you guessed it poned open code more like open poned and even railway got railed. It seems like pretty much everything just got hacked and the reason is cuz it did. This is horrible. This is one of the most unprecedented days in the history of software in terms of how many things just got destroyed. I've been trying to raise the alarm bells about this for a while now. It is not surprising to me that LLMs are now at the point where all of these types of things will happen. All that said, I actually feel a little bit bad about how I'm starting this video because it's almost misleading in a way. The reality is that two different things are happening at once right now. On one side, we have the CVE like with Node, GitLab, PHP, Quick, Light LLM, and …