Half the internet got a security advisory on Tuesday. Here’s which half you’re in.

The hackers want your AI keys. They’re using AI to get them.

If you’ve opened a news app this week you’ll have seen some version of “the internet has a hole in it”. Several, all in the same few days. Clients have asked the same two things: does this touch us, and does it touch you? Here’s the honest answer to both, and what to do about it.

But first, the thread running through all of it, because the headlines missed it. The thing being stolen this week is AI credentials. And the thing doing the stealing, increasingly, is AI.

What happened

• PHP. The NSA warned on 21 October about two critical flaws in PHP itself, nicknamed PHP2Shell. PHP sits under WordPress, WooCommerce, Magento and Laravel. An attacker can take over the server without logging in. Amazon’s honeypots caught an attempt on 17 October, four days before anyone announced it. The fix is a PHP update, and PHP 8.1 and older get no fix at all.
• Node.js. Same day, Node patched ten issues, the worst a decompression bug that can be pushed to run code on the server. Node is the engine under most modern web apps, ours included. The big hosts are patching.
• Railway. A startup hosting platform had its customer secrets store accessed. Railway says the attacker was after AI provider keys, and that it’s one of a series of attacks on platforms for that purpose. Everyone on it has been told to rotate everything.
• LiteLLM. A popular tool for routing traffic to AI models was poisoned on the same day. The bad version sat on the public package index for two hours, built from a lookalike project with one extra hyphen in its name. It runs every time Python starts and steals Claude, Cursor and Copilot keys, cloud credentials and password files. Second time this year for that project.
• Storm-0940. Microsoft reported a state-aligned group using an AI penetration-testing framework against hundreds of organisations since September. It tried to sign in to over 2,250 companies through a trusted vendor’s apps at nearly 3,000 attempts a minute. In several cases it went from first contact to full admin in under three hours. No password needed: the apps had already been granted access. One of them promoted itself to Global Administrator.

Also this week: GitLab patched a top-severity flaw in every version since 2014, which only matters if you host your own. Chrome shipped 353 fixes. Restart your browser.

What we run

You trust us with your ad accounts, analytics and in some cases your CRM, so here’s what sits underneath.

• agentcroft.com is a static site served from Vercel. No PHP, no WordPress, no database behind the page.
• Agentcroft Insights runs on Node.js on Vercel, so the Node advisory is our one direct hit. We’re on the Node lines Vercel patches itself, Vercel’s firewall was blocking the known exploit patterns before the fix itself landed.
• Your AI keys, the ones you give us and the ones we hold, live in Vercel and Supabase. Not Railway, not LiteLLM, not a Python box. We re-check every stored key daily, so a key that dies gets noticed by us rather than by you.
• Railway, LiteLLM, GitLab, ConnectWise: we don’t use them.

I’m not writing “we have no vulnerabilities”, because nobody can honestly say that about anything. I can say which of this week’s problems apply to what we run and what was done about the one that did.

What you should do

1. Find out if you’re on PHP. WordPress, WooCommerce, Magento, Drupal or Laravel means yes. Email your host today: “Which PHP version are we on, and has PHP2Shell been patched?” Fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Anything starting 8.1 or 7 needs an upgrade, not a patch. If they can’t tell you the version, that’s its own answer.
2. Rotate your AI keys. If an OpenAI, Anthropic or Google key has been on Railway, in a LiteLLM setup, or on any developer machine that ran Python this week, treat it as copied. From now on, treat AI keys like passwords: they are what’s being hunted.
3. Audit the apps with standing access to your accounts. Google (myaccount.google.com/permissions), Microsoft 365 enterprise apps, Meta Business Settings, your CRM, Shopify. Every app listed can act as you without ever logging in again, which is exactly how the three-hour takeovers worked. Remove the ones you don’t recognise or use. We’ll be on those lists for our clients, and nowhere you don’t expect.
4. Turn on MFA where it’s still off. Ad accounts and the email that owns them first.
5. Ask every supplier the question you asked us. A good one answers in a paragraph. One who says “we’re fully secure” and nothing else has told you something too.

The bit nobody wants to hear

PHP2Shell was being exploited four days before it had a name. The AI-driven attacks went from knock on the door to full admin in three hours. The gap between a flaw existing and your business being hit has gone from weeks to hours, and “someone will spot it” stops working as a strategy. We built the platform on that idea: when something breaks, we want an alert, never silence. Worth asking whether the rest of your stack would tell you.

If you’d like us to run through your hosting, your AI keys and your connected apps with you, reply to this or message your account lead. It’s a thirty minute job.