Come To Think of It...

BleepingComputer reported yesterday that the security firm Forever Security found a malicious AGENTS.md file sitting in a customer's Downloads folder. Not a script, not a binary — a plain markdown file. When a coding agent was pointed at that folder, it read the file as project instructions and cheerfully set about installing a known-malicious npm package. The firm blocked that install, then went looking for the software flaw that made it work. There wasn't one. Reproducing the same trick against OpenAI Codex and Claude Code, Codex ran the malware in more than 90% of attempts — not because a bug allowed it, but because the agent did exactly what the file told it to do. That's the entire point of AGENTS.md, which is why there is no patch coming. AGENTS.md and its cousins (CLAUDE.md, Copilot's equivalents) exist to make coding agents useful: build commands, test steps, repo house rules, loaded automatically from the working directory with the implicit trust you'd give...

On October 21, the PHP project quietly fixed two remote code execution flaws in the language itself — CVE-2026-109618 and CVE-2026-109619, together nicknamed PHP2Shell, each scoring 9.2 on CVSS v4.0. What makes them uncomfortable is not the score. It is where they live. These are memory-safety bugs in the PHP engine: an out-of-memory condition that can interrupt PHP while internal request data is only half-initialized, and a stale-state bug where memory freed after one request gets reused by the next worker before it is reset. There is no framework patch, no application-level fix, no dependency bump that makes the problem go away. The fix is the interpreter: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or you are exposed. Datadog Security Labs independently reproduced both flaws and confirmed the part that should get every admin's attention: PHP processes the malicious request before any application code runs, so your login screens, your middleware, and your carefully written auth chec...

At PyTorch Conference North America this week, two backends landed almost simultaneously. Google and Meta open-sourced TorchTPU, a native PyTorch backend for Google TPUs. A day earlier, AWS shipped TorchNeuron as a public beta — an Apache-2.0 native PyTorch backend for Trainium, the chips powering EC2 Trn2 and Trn3 instances. Both register through PyTorch's PrivateUse1 device extension point, which means the standard APIs torch.nn, torch.distributed, torch.autocast, torch.profiler just work. Running a training loop on Trainium takes one added line: model.to('neuron'). Switching a compiled model takes one backend flag. That's the whole migration story at the code level. Here's why the mechanism matters more than the marketing. For years, "CUDA lock-in" was less about the hardware being irreplaceable and more about the switching cost being a rewrite — vendor toolchains, compiler glue, profiling that stops working, libraries that only exist on one stack. AW...

Ransomware headlines usually smuggle in a new trick — a zero-day, a novel loader, some clever bit of tradecraft. SafePay, the group CISA and the FBI just spent a joint advisory on, has no trick at all. And that's exactly what makes it worth a few minutes of your attention. On October 20, CISA, the FBI, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, and the UK's National Crime Agency published a joint advisory on SafePay, a ransomware operation that has hit at least 600 organizations across critical infrastructure sectors in North America, South America, Europe, and Australia since August 2024. The initial access story is almost insultingly ordinary: exposed or stolen credentials, brute-force password guessing, and exploitation of VPN appliances — with the advisory specifically calling out IP addresses belonging to the VPN provider Mullvad. No exploit kit fireworks, no supply-chain worm. There is a supply-chain flavor, though: the group's 2025 atta...

Everyone is framing tsrs — the Rust port of the TypeScript compiler that Cloudflare and VoidZero just took over — as another compiler-rewrite story, and that misses the point. The rewrite was never really about making humans wait less for red squiggles. It was about making validation cheap enough that AI coding agents can run it thousands of times a day without eating a machine alive. That's a different problem, and the fix looks different. The numbers from Owner.com, where the port started, make this concrete. Their backend monolith has roughly 37,000 TypeScript files checked as a single program. One pass with TypeScript 7.0 needed 19 gigabytes of memory and about 80 seconds. Stack the linter, the language server, and a dev server on top of that and validation alone climbs past 50 gigabytes — more than fits on a 36-gigabyte laptop. Head of AI DX Max Schwenk wrote that engineers couldn't run several coding agents in parallel without risking the machine locking up. The attempte...

Patch Tuesday landed on October 13, and on some on-premises deployments the fallout still hasn't stopped: Outlook on the web refusing sign-ins, mail sitting unsent in the Outbox, delivery queues swelling through the day. The Application log fills with a brutal-sounding error, MapiExceptionMdbOffline , logged as event ID 1006, which reads like a mailbox database coming apart. Except Microsoft's own Exchange Team took pains to point out that this month's breakage is not caused by the Exchange security update released the same week. It's caused by the Windows Server updates underneath Exchange. The affected combination is specific: Exchange Server 2016, 2019, or Subscription Edition running on Windows Server 2019 or later, with instability surfacing some time after certain October servicing KBs go in. The symptoms aren't one clean failure mode you can unit-test against. Some shops see OWA errors, some see mail crawling toward a full stall, and some report DAG members...