Eversynced AI Weekly - October 26, 2026

Your Monday briefing on AI that matters for developers.

Issue #17 - October 19 - October 25, 2026.

This Week’s Big Move

PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21 to fix two critical bugs that “can allow unauthenticated remote code execution” (security advisory). CVE-2026-109618 is code execution through out-of-memory corruption, and CVE-2026-109619 is code execution through stale global state. PHP’s GitHub advisories score both at CVSS 9.2. PHP says every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and it rates mod_php highest. Wiz, which calls the pair PHP2Shell, ran unauthenticated code on the latest WordPress, Drupal and Joomla container images. It adds that “even a simple ‘Hello World’ application” on an affected version can be vulnerable.

PHP is blunt about the cost: “There are no complete mitigations, updating is the only safe choice.” PHP 8.1 and older get no project updates, but given the severity, PHP published minimal source backports for 7.4, 8.0 and 8.1 for people who build their own. If you can’t update right away, the advisory lists stopgaps that “do not make an installation safe.” For CVE-2026-109619, set session.upload_progress.enabled=0 and restart every worker. For CVE-2026-109618, set memory_limit=-1, preferably where applications can’t override it, and lower post_max_size.

The release also came a day early. The PHP Foundation says the CVE IDs leaked on October 20 with a wrong score of 10.0, so PHP moved the release from October 22 to October 21. Chainguard then published patched images more than six hours before the coordinated release. On October 23 PHP added an informational advisory for a third, “unlikely” vector, CVE-2026-115560, which the same upload-progress setting blocks until the next regular release.

The part that changes what you build is who found them. Wiz says it used its Atlas agent, Gemini 4 Argon and GPT-5.6 Sol, and that “a single researcher completed in a week what previously would have taken a world-class team months of work.” OpenAI says Calif found a critical flaw with GPT-5.6 Sol through OpenAI’s Patch the Planet initiative, and that Wiz independently found and reported both bugs. The Foundation adds that a PHP core developer found first signs of the out-of-memory problem in 2024, while fixing an issue from an outside audit. In Wiz’s words, “what AI changed was the ability to understand the weaknesses and turn them into a working exploit.” To check your own hosts, try OpenAI’s php2shell-checker, a PHP version checker packaged as a Codex skill.

Issue 16 led with Gemini 4 Argon going generally available. Wiz now credits Argon with “an invaluable contribution” to finding, exploiting and patch-testing these bugs.

Tools & Agent Updates

Claude Code v2.1.304 to v2.1.310 - Seven releases from October 19 to 23. v2.1.304 added /auto-mode-setup, which reads your project and recent sessions to teach auto mode about your environment, and turned tool search on by default behind a custom ANTHROPIC_BASE_URL. v2.1.305 stopped allowedMcpServers from filtering some managed-mcp.json stdio servers, so a server your allowlist left out can now load after you upgrade. v2.1.307 added a claude_code.safety_event OpenTelemetry event for each tool call that a permission rule, auto mode, a safety check, a hook or the sandbox “stopped, prompted or sent back.” And v2.1.309 made claude ultrareview require workspace trust.

Agent Skills joins the AAIF - Anthropic donated the Agent Skills standard to the Agentic AI Foundation under the Linux Foundation on October 22, the same home it gave MCP. Anthropic counts more than 70 agent platforms using it, including ChatGPT, Cursor, GitHub Copilot and VS Code, plus 1 million skills published and nearly 280 million installed.

OpenAI Decisions API - Generally available since October 22. It runs GPT-6 Luna on questions with bounded answers, like routing or classification, and OpenAI says it’s up to 10x faster than Luna through the Responses API. Input costs $0.10 per million tokens, cached input $0.01, and there’s no output charge.

Vercel durable-harness - An open source package from October 19 that keeps Pi, OpenCode, Codex and Claude Code sessions in a durable log. If a turn crashes, a new function reads the completed results and resumes it.

The Keys Were the Way In

Three posts from October 21 to 23 came back to the same weak point, credentials:

• LiteLLM 1.107.0 - A malicious litellm==1.107.0 was on PyPI from 11:39 to 13:23 UTC on October 21, and four Docker Hub tags, including latest, pointed at it until 14:20 UTC (incident post). LiteLLM traces it to a master key committed on May 27, force-pushed over and never revoked. That key unlocked an internal agent platform holding an organization owner’s GitHub CLI OAuth token, “not associated with a service account and … not scoped down.” Wiz counts about 49,000 downloads, citing ClickPy, and says the payload also reads LiteLLM Proxy’s stored provider keys.
• Death to long-lived static credentials - Vercel’s October 22 case for OIDC, where a trusted issuer hands your app a signed, short-lived token instead of a stored key. Vercel ships OIDC UI, a shadcn/ui registry with trust-policy forms and token verification code, and sets new authentication requirements for Marketplace providers.
• How Vercel Agent accesses production - Published October 23. Read-only investigation runs on its own, and any plan that needs more, such as a read-write:deployment scope for a redeploy, “waits for approval as a whole.”

LiteLLM had hardened its pipeline after a March incident: private release repo, trusted publishing, immutable Docker tags and signed images, per its GitHub status update. None of that stopped an unscoped token that belonged to a person and sat inside an agent platform. The release gate normally needs approval from an account locked to a physical device, and LiteLLM had relaxed it to any two engineers in the week of October 19, to ship more frequent releases and bugfix backports. Our read: agents need credentials to do anything, and the fastest credential to hand one is your own. Give each agent its own identity with a scope and an expiry, and revoke every secret that ever touched a commit, even a force-pushed one.

What This Means for You

What Matters

• Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Check your distribution’s packages first, since vendors got the patch in advance. On 8.1 or older, ask your LTS vendor, build from PHP’s source backports or upgrade to a supported version (advisory).
• Check for litellm==1.107.0 and for LiteLLM Docker pulls on October 21. Unpinned installs from 11:39 to 13:23 UTC and the v1.107.0, latest, main-latest and main-stable tags from 11:46 to 14:20 UTC are affected. Don’t start with pip install, because starting any Python process reruns the payload. Remove cook.pth, cook.py and sitecustomize.py, rebuild pinned to 1.106.2 and rotate what the host could reach (LiteLLM).
• Add --trust-workspace to scripts that call claude ultrareview. Since v2.1.309 it refuses without trust when no terminal is attached. CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1 also works (changelog).
• Admins: recheck managed-mcp.json after upgrading Claude Code. Since v2.1.305, allowedMcpServers no longer filters stdio servers that use ${VAR} only in env, so list any that should stay off in deniedMcpServers (changelog).

What’s Noise (for now)

• Mistral Large 4 as an open-weight model. The Hugging Face page is still a placeholder: “Open weights drop at the end of the month,” with October 31 as the expected date. Until files and a license show up there, it’s an API model. Check the repo, not the post.
• Kimi K3.1 Pro open weights. Moonshot says “Full model weights will be released by Nov 4, 2026.” Artificial Analysis scores the API model 55 on its Intelligence Index, 4th of 221, and Vals AI puts it 8th of 27 at 62.52%. But the moonshotai Hugging Face org has nothing newer than Kimi K3.
• OpenAI models on Google Cloud. Announced October 21 for Model Garden. OpenAI says “General availability is planned in the coming weeks” and links an access request form. So there’s no date yet. Google’s post says the models are already “rolling out now in private preview to select enterprise customers.”

Our Take

Finding bugs got cheap. Fixing them didn’t. The PHP Foundation says its security team has published 15 CVEs since July 1 and worked through more than 100 reports that were invalid, duplicates or impossible to reproduce. Its own line is the one to keep: tools can’t “decide on the right fix for a long-standing design decision in the engine,” and “today there are too few” engineers who can.

So budget for the fixing side. If your product runs on an open source runtime, the cheapest security spend you’ll make this year is funding the people who patch it. And run a patch drill before the next one: know which hosts run which version, who can roll a fleet in a day and what you’ll do when a fix leaks early. AI-found bugs will keep arriving in batches.

Quick Links

• Claude on Google Cloud, Anthropic-managed - A second deployment option, generally available October 22, with Claude Platform features like Managed Agents (beta) on day zero
• Claude Opus 5.5 and Sonnet 5.5 in Antigravity - In the model picker across Antigravity 2.0, its CLI and IDE extensions once an admin turns the models on
• PHP 8.6.0 RC4 - Carries the same two fixes, and PHP says not to use it in production
• LiteLLM indicators of compromise - Wheel hashes and the cook.pth, cook.py and sitecustomize.py files to search for
• Anthropic guest investigators - 8 to 12 weeks with Anthropic researchers on a life sciences problem, with applications open for about 14 days from October 22

Glossary

CVSS - The Common Vulnerability Scoring System, a 0 to 10 severity score. Both PHP2Shell CVEs score 9.2, and the leaked IDs circulated with a wrong 10.0.

Trusted publishing - Publishing a package from CI with a short-lived token tied to that workflow, instead of a stored API token. LiteLLM used it, and stolen GitHub CLI tokens still got a malicious release through.

OIDC - OpenID Connect. A trusted issuer gives your app a signed, short-lived token, so it never stores a long-lived key. Vercel is expanding it across its own services and Marketplace.

GitHub CLI OAuth token - The token gh stores after you log in. It carries your account’s access, and LiteLLM notes it isn’t subject to GitHub’s 2FA re-authentication on sensitive actions.

Workspace trust - Claude Code’s check that you trust the project folder it’s running in. claude ultrareview requires it since v2.1.309.