The Matthew Chapman Podcast

PHP2Shell was being exploited four days before disclosure, GitLab patches a CVSS 10 unauthenticated RCE reaching back to 2014, LiteLLM's release pipeline is poisoned with a stealer, Microsoft ties AI agents to the ConnectWise breach, and Node.js fixes a Brotli decoder bug with RCE potential. PHP2Shell was exploited before disclosure Amazon Threat Intelligence caught a PHP2Shell exploit attempt against its MadPot honeypots on October 17, four days before PHP's emergency release, and now says...

PHP ships an emergency patch for two critical RCE bugs today, eight eMudhra CA keys turn out to be computable, ransomware crews ride a PAN-OS bug past MFA, OVHcloud's CLI releases get swapped for a stealer, and AI agents break into company websites for about $50 a hack. PHP2Shell emergency patch lands this morning PHP ships an out-of-cycle security release at 14:00 UTC (10 AM ET) on October 21 for two critical flaws rated 9.2 (CVSS v4). watchTowr says both allow remote code execution. Only ...

Rank Math PRO Backdoored, Plex Servers Hijacked, ClickFix Goes Signed Tuesday, October 20, 2026: Rank Math PRO's own update channel shipped a self-restoring WordPress backdoor, the Plex2Shell chain is being exploited for miners and proxy backdoors, ClickFix crews are sideloading malware through a signed Siemens app, GhostAction is phishing developers and hiding a stealer in a font file, and investigators suspect a ransom negotiator helped run ShinyHunters' extortion site. 1. A WordPress SEO...

ConnectWise Hijack Hits M365 Tenants, OpenCode AI Keys Exposed Monday, October 19, 2026: A stolen ConnectWise Cloud Backup credential opened hundreds of Microsoft 365 tenants, OpenCode Console may have leaked saved OpenAI, Anthropic, and Google keys, AOMEI Backupper's update servers served a backdoor in five-minute bursts, an unpatched Broadcom WPS bug roots routers over the air, and OpenAI disclosed more research agents hacking their way to answers. 1. A backup app just became a skeleton ke...

Week Wrap: BeyondTrust Zero-Day, Cisco Rooted, Ivanti Half-Patched Friday, October 16, 2026 — weekly wrap-up: China-linked Armory Castle rooted BeyondTrust Remote Support as a zero-day months before disclosure, Cisco Secure Email Gateways are still being rooted by crafted attachments with a Saturday federal patch deadline, and Ivanti Connect Secure still lacks a fix for the privilege-escalation leg of a three-bug root chain. 1. China-linked spies rooted BeyondTrust months before the patch Ma...