The Brief

New briefs daily around 7 AM Eastern

PHP ships early fix for php2shell, a 14-year-old RCE found with AI

Brockman says the bug let attackers run code on nearly all deployed PHP apps, and Wiz traces it back to PHP 5.4. Models found it in August, yet the fix took two months of manual coordination and still leaked a day early, a pace he says will not scale.

• 01Read

  Railway says attackers decrypted customer environment variables

  The exposed variables include API keys, and Railway links the attack to a campaign against platform companies aimed at AI inference providers. All builds are paused while it investigates, so customers face both possible key exposure and blocked deploys.

  passenger→
• 02Read

  Compromised LiteLLM 1.107.0 on PyPI installs a credential stealer

  The release drops three files into site-packages that run a stealer and a remote-code backdoor on every Python start, not only when LiteLLM is imported. LiteLLM is a common gateway for model API keys, so an infected host exposes the credentials it was built to route.

  abhisek→
• 03Read

  Anthropic opens Claude Duet personal agent preview to US Pro and Max

  Duet handles inbox, calendar and follow-ups while the user is away and stops for approval on key actions. After two weeks of testing, Dan Shipper says it can see his local Claude sessions but not direct them, and voice is transcription only.

  kuberwastaken→Dan Shipper→Peter Yang→
• 04Read

  GitHub lifts busy-repo Git write throughput 3-4x with per-ref locks

  Agent traffic and data center power limits forced GitHub's move to Azure, and a 25ms cross-region trip capped the busiest repos. Locking per reference, not per repository, lets agents pushing to separate branches stop queueing behind each other.

  Eleanor White→GitHub→
• 05Read

  Devin Fusion scores 68.1 on AA's coding index at $9.01 per task

  Claude Code on the same Opus 5.5 lead scores 66.0 at $13.04 and 65 minutes per task. Fusion hands work to a cheaper GPT-6 Luna sidekick, so its per-task cost falls 31% and its run time falls 10 minutes while the score rises.

  Artificial Analysis→
• 06Read

  OpenAI API adds optional 12-hour prompt cache retention

  The default cache expires after 30 minutes, so an agent idle between requests paid full input price to reload its instructions and tools. Twelve-hour retention keeps that prefix at the cached-input rate across a working day, for an added caching charge.

  OpenAIDevs→