Tap Notes: Cheap Discovery, Expensive Review
Finding bugs got cheap. Reviewing what machines produce did not. Most of today’s reading sits on one side of that gap or the other: a PHP patch day, a poisoned AI dependency, and a 12-hour agent run that left behind more code than any human will read.
The PHP patch you’re already late on
PHP2Shell: AI uncovers critical RCE in PHP
Wiz reports an unauthenticated RCE in core PHP, affecting every version back to 5.4, found with AI-assisted research. Jeff Geerling’s writeup covers the practical side: two advisories, both rated 9.2/10, fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The PHP Foundation’s release post adds that the unauthenticated case hits mod_php on default settings.
Why it matters: If you run WordPress, PMPro, or anything else on PHP, stop reading and patch. Geerling also flags a trap: if you use Remi’s repos on RedHat-derivative distros, switch to official packages for now, because Remi is on vacation and the community repo won’t update. The bigger point is that this bug survived for years and fell to AI-assisted research. Expect more of these, and expect the patch window to shrink.
The package that wasn’t in the repo
Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor
Version 1.107.0 of LiteLLM on PyPI shipped a credential stealer and backdoor. It came in through a maturin data = "cook" line in pyproject.toml, and the line isn’t in the GitHub source.
Why it matters: Reviewing the repo would not have caught this. The malicious part lived in what got published, not in what got reviewed. And the target was an AI gateway library, which sits next to exactly the credentials an attacker wants: provider keys. If your agent stack pulls from PyPI, pin versions and diff the built artifact against the source, not just the tag.
When the breach is the whole database
A disclosure against PingCAP’s TiDB Cloud claims 10.6TB exfiltrated, 88 undetected exports running every six hours, and plaintext API keys lying around. These are the disclosure’s claims, not confirmed findings.
Why it matters: Take it as a case study in managed multi-tenant data. Eighty-eight exports on a six-hour cadence means nobody was watching egress for weeks. Plaintext keys mean one foothold fans out. Read it as a checklist: do you alert on bulk export, and are your secrets actually encrypted at rest?
Next-level vibe coding, with a bill for understanding
sparqlite: SPARQL 1.1 inside SQLite, written in Rust
Simon Willison ran Claude Code in “Ultracode” mode, where it generates JavaScript that coordinates a network of subagents. A prompt with a typo, typed on his phone, produced a Rust SPARQL extension for SQLite over 12+ hours. A single follow-up asked for READMEs and a tutorial.
Why it matters: His own conclusion is the interesting part. It isn’t feasible to review the output, so what is a full SPARQL implementation worth if you can’t or won’t invest the time to understand it? Generation scaled. Comprehension didn’t. Pair this with the LiteLLM item above and you get the same problem from two ends: code that exists but nobody has read.
Storefronts get a tool menu
How Commerce.com and Cloudflare are getting storefronts ready for AI agents
Almost 100,000 Commerce.com domains now expose real shopping tools to AI agents through WebMCP on Cloudflare, switched on across every store at once while each merchant keeps control.
Why it matters: Agents shopping by scraping HTML is a bad arrangement for everyone. Structured tools give merchants a defined surface to govern. If you run an e-commerce or membership site, “what can an agent do here, and who decided?” is about to become a real design question.
A background agent that asks first
Anthropic’s new proactive agent runs in the background, briefs you, and asks before sensitive operations. It’s powered by Opus 5.5 and limited to Pro/Max in the US.
Why it matters: The product claim worth watching is the “asks before sensitive ops” line. Proactive agents live or die on where they draw that boundary. Too many prompts and you stop reading them. Too few and you’re explaining an incident. Every agent builder will land on some version of this threshold.
Cheap discovery, expensive review. The people who win the next year are the ones who invest in the expensive side. 🪨