LLMs
Developer Tools
What Is Cursor Origin? The GitHub Rival Built for Agents
Cursor's Origin launched in beta on August 17, 2026, the same day GitHub went down for 7.5 hours. Here's what it actually ships, and what it still can't do.
•11 min read
In 8 days, PHP2Shell hit 70% of the web, eMudhra lost 8 CA keys, and LiteLLM, OpenCode, Railway and Zeabur leaked secrets. Here's what to patch and rotate.
Working on this in your product? See how Apex36 handles AI consulting and development, or book a free strategy call.
On October 21, 2026, TechCrunch ran a headline that summed up the week: "The internet is having a very bad cybersecurity day" (TechCrunch, 2026). It wasn't one bad day, though. It was eight.
Between October 14 and 22, a PHP flaw put roughly 70% of the web at risk. An Indian certificate authority lost control of eight signing keys. A popular AI library shipped malware from its own release pipeline. And three developer platforms leaked the secrets their customers trusted them with. People online started calling it "Black October."
This post walks through all six incidents, what they share, and the exact checklist we'd run on any stack this week.
Key Takeaways
- PHP2Shell affects PHP 5.4 to 8.5, roughly 70% of websites (Fortune, 2026). Patch to 8.2.35 or later today.
- Four of the six incidents ended in stolen secrets, not broken code.
- Rotate every API key stored on LiteLLM, OpenCode Console, Railway or Zeabur, starting with AI provider keys.
In eight days of October 2026, six separate incidents hit three layers developers rely on: the language runtime (PHP), the trust layer (eMudhra certificates) and the platform layer (LiteLLM, OpenCode, Railway, Zeabur), per reporting from TechCrunch, CERT-EU and BleepingComputer. None caused the others. They just landed in the same week.
| Incident | Date (2026) | Layer | What's at risk | Your action |
|---|---|---|---|---|
| PHP2Shell | Oct 21 patch | Runtime | Remote code execution, no login | Upgrade PHP |
| eMudhra keys | Oct 17 report | Trust | Fake certificates for any site | Update trust stores |
| LiteLLM 1.107.0 | Oct 21 | Package | Credentials on the install host | Check versions, rotate |
| OpenCode Console | Oct 16 | Platform | Stored AI provider keys | Revoke keys |
| Railway | Oct 21 | Platform | Environment variables | Rotate all secrets |
| Zeabur | Oct 14 to 15 | Platform | 3.2M env var records | Rotate and migrate |
Why does the "darkest week" label stick? Because the cleanup lands on everyone at once. Security people quoted by daily.dev said the eMudhra cleanup alone is bigger than Heartbleed. Add a PHP patch and four secret rotations, and most teams lost a sprint.
In October 2026, two flaws, CVE-2026-109618 and CVE-2026-109619, were rated CVSS 9.2 and found to affect every PHP version from 5.4 to 8.5, roughly 70% of the web (Fortune, AI tools discovered the PHP vulnerability, 2026). Both allow unauthenticated remote code execution.
The bugs sit in the interpreter itself, in session handling, OPcache class caching and fatal-error backtraces. That's what makes this one different. Your WordPress or Laravel code can be perfectly clean and still be exploitable, because the flaw lives below it (The Next Web, 2026).
PHP shipped fixes on October 21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (CERT-EU, Security Advisory 2026-018, 2026). There's no release for PHP 8.1 or older. If you're still on 8.1, you're not "a bit behind" anymore. You're unpatched with no fix coming.
The disclosure also went badly. Details leaked on social media before the planned October 22 date, and the PHP team publicly blamed Chainguard for revealing the bugs early (The Register, 2026). Amazon found an exploitation attempt dated October 17, and watchTowr saw attacks in the wild from October 21 (watchTowr, PHP2Shell FAQ, 2026).
The NSA's advice was blunt: update now or take systems offline until you can. Government sites went dark, and organizations in Finland and Japan pulled services as a precaution (CNN, 2026). The bugs were found through AI-assisted research credited to Wiz, Calif and OpenAI, which is why some outlets framed this as the first "AI-found" internet-scale bug.
PHP2Shell is a pair of unauthenticated remote code execution flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) in the PHP interpreter, affecting versions 5.4 through 8.5. Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, published October 21, 2026. PHP 8.1 and earlier receive no patch.
For the wider pattern of AI models finding zero-days faster than vendors can patch them, see our breakdown of why AI sandbox escapes at four labs share one root cause.
On October 17, 2026, a researcher showed that private keys for eight eMudhra intermediate certificates had been generated with too little randomness, so anyone could compute them from the public certificates (The Hacker News, 2026). With those keys, an attacker could issue a valid-looking certificate for any domain.
eMudhra traced it to a flawed key generation ceremony in April 2025 and revoked all eight intermediates on October 18 (eMudhra statement, 2026). Chrome and Firefox blocked them almost immediately. Apple and Microsoft followed, and Mozilla also distrusted one ECC root (Mozilla Security Blog, 2026). On October 22, eMudhra said it would exit the global SSL/TLS business.
Here's the good news. As of October 21, no malicious certificate had been found in Certificate Transparency logs. Browsers are covered.
Our take: Browsers aren't where this bites. Backend services are. A Python service with a pinned
certifi, a Java app with an oldcacerts, or a Docker base image from last spring will keep trusting those intermediates until you rebuild. Most of them never check revocation. If your services make outbound HTTPS calls, the fix is to update CA bundles and rebuild images, not to wait for a browser update.
Endor Labs made the same point: the trust stores you patched aren't the risk, the ones you forgot you had are (Endor Labs, 2026).
On October 21, 2026, a malicious litellm==1.107.0 was published to PyPI through LiteLLM's real release pipeline and stayed live for about two hours, from 11:39 to 13:23 UTC (LiteLLM, Security incident Oct 21, 2026, 2026). Docker tags v1.107.0, latest, main-latest and main-stable served it until 14:20 UTC.
The package was a working copy of LiteLLM with three extra files that run at Python startup. They steal credentials and open an hourly remote code channel (JFrog Security Research, 2026). JFrog warns that deleting the package folder may leave the startup files behind, so a plain pip uninstall isn't enough.
How did attackers get in? LiteLLM says stolen GitHub CLI OAuth tokens, likely lifted from the logs of an exposed internal deployment (The Hacker News, 2026). It's LiteLLM's second supply chain hit this year, after versions 1.82.7 and 1.82.8 were backdoored in March.
The cruel part? LiteLLM is an AI gateway. The machines running it hold API keys for OpenAI, Anthropic, Google and every other provider a team uses. A stealer on that box gets all of them at once.
On the night of October 16, 2026, an intruder reached a legacy OpenCode system that was being shut down and may have accessed the OpenAI, Anthropic and Google API keys that teams had saved in OpenCode Console (The Hacker News, OpenCode Console breach, 2026). About 1.4% of Console users were affected.
The open source OpenCode CLI and desktop app weren't affected. They keep keys in a local SQLite database on your machine. Only keys pasted into the hosted Console were at risk, co-founder Dax Raad said. OpenCode emailed every affected user and worked with the three providers to revoke keys.
OpenCode linked the theft to a large-scale distillation attack. That means using stolen keys to query frontier models at high volume and harvest the answers to train a rival model. Users reported surprise bills: one saw $281 on OpenAI and $168 on Anthropic, another put losses at $1,700. Those are user reports, not company figures.
Is the distillation angle confirmed? Not independently. But it matters, because it explains why attackers suddenly want AI keys so badly. A stolen key isn't just free compute anymore. It's training data at someone else's expense.
On October 21, 2026, Railway detected unusual activity in the systems that store customer environment variables, and said an attacker may have read encrypted variables and, in some cases, their decrypted contents (TechCrunch, Railway urges all users to revoke secret keys, 2026). It paused all deployments and told every customer to rotate.
Railway says only a subset of users were affected but hasn't said how many. It revoked and reissued storage credentials, signed some users out and promised a full postmortem (The Hacker News, 2026). As of October 22, builds were still paused.
The most telling line in Railway's disclosure was the motive. It tied the incident to "a series of attacks recently targeting platform companies with the aim of compromising AI inference providers." That's the same motive behind the OpenCode keys.
There's also an unconfirmed crypto angle. Researcher Taylor Monahan reported about $371,000 drained from wallets whose keys sat on Railway. Railway hasn't confirmed the link, and Symantec said it had seen no evidence tying them together. GitGuardian's advice is the safe default anyway: treat every environment variable on Railway as exposed (GitGuardian, 2026).
Zeabur, a developer hosting platform, said attackers used leaked internal credentials on October 14 and 15, 2026 to take 3.2 million environment variable records and data on 321,810 accounts (BleepingComputer, 2026). The credentials likely came from an earlier breach in August.
The root cause is painfully ordinary. Administrator tokens hadn't been rotated since January 2024, and admin portals were exposed to the public internet. Attackers got root on 101 Google Cloud servers, added SSH keys to 50 of them and copied 16 customer disks.
Zeabur won't recover from this one. Some services shut down on December 1, 2026, and everything else by December 31 (Zeabur, Zeabur is shutting down, 2026). If you host there, you need to rotate secrets and migrate before then.
Four of the six October 2026 incidents (LiteLLM, OpenCode, Railway and Zeabur) ended in stolen secrets, not exploited application code. Railway itself linked its breach to attacks aimed at AI inference providers (TechCrunch, 2026). The target was the key, not the app.
Our finding: Three of the four secret thefts started with a long-lived credential somebody forgot about: Zeabur's 2024 admin tokens, LiteLLM's GitHub OAuth tokens sitting in logs, and OpenCode's half-retired legacy system. Nobody broke strong crypto. They found keys that should have expired.
That changes how we think about AI keys. In most teams we work with, an OpenAI or Anthropic key gets pasted into three or four places: a hosting platform, an AI gateway, a CI secret, a coding tool's cloud console. Each copy is a new place to steal it from. And unlike a database password, a stolen AI key pays the attacker straight away, in compute or in distillation data.
So is AI to blame for Black October? Partly. AI helped find PHP2Shell, and AI keys were the prize in most of the thefts. But the failures themselves were old ones: weak randomness, unrotated tokens and secrets in logs.
Start with exposure, not with what's easiest. PHP2Shell is being exploited in the wild as of October 21, 2026 (watchTowr, 2026), so internet-facing PHP comes first. Secrets on breached platforms come second, because attackers have had them for days.
php -v inside every container, not just on hosts. Anything on 8.1 or older needs a WAF rule now and a migration plan this month.pip show litellm and check Docker image digests pulled on October 21. If you find it, rebuild the host, don't just uninstall, then rotate every key that machine could read.certifi, Java cacerts, OS packages) and rebuild Docker images so backends stop trusting eMudhra's revoked intermediates.The fastest way to break a stolen key is to make keys short-lived and narrow. If you're running AI agents with broad permissions, our look at what happened when Claude broke into three companies during security tests shows why scoping matters just as much there.
Black October didn't need a clever new attack. It needed keys that lived too long in too many places. Fix that, and next month's headline is somebody else's problem.
We'll audit your keys, PHP and pipelines with you.
How Apex36 helps
RAG search, AI agents and integrations with your systems, built to production with guardrails and evaluations.
Case study: DecoverAI (Legal Tech · eDiscovery)
Continue exploring these related topics
Cursor's Origin launched in beta on August 17, 2026, the same day GitHub went down for 7.5 hours. Here's what it actually ships, and what it still can't do.
Smart AI glasses shipments hit 13.6 million units in 2026, led by Meta's Ray-Bans. Here's what's fueling the boom, and the privacy backlash trailing it.
Anthropic reviewed 141,006 evaluation runs and found Claude breached three real companies during security tests. Here's what happened and how to respond