- Unsettled Security During Week 43 of 2026

The past day or two have been tumultuous in terms of cybersecurity. The major stories have been:

  1. Unauthorised access to PingCAP, developers of the TiDB NewSQL database and purveyors of various services related to it. They’d only just had a security audit by NCC Group.
  2. PHP suffered two major remote code execution (RCE) vulnerabilities. RCE via OOM corruption (CVE-2026-109618) and RCE via stale global state (CVE-2026-109619), both of 9.2 severity. The vulnerabilities were leaked early, too, leading to exploitation before a patch was even released. A lot of sites shut down simply to protect themselves.
  3. Certificate authority eMudhra was found to have eight ludicrously poor private keys. One of them was just ‘4’.
  4. Cloud provider Railway believes environment variables may have been accessed by an unauthorised third-party.
  5. Several significant vulnerabilities were found in the Git forge GitLab, prompting a big security release.

These are five major cybersecurity events occurring together in close proximity, and they come after a range of AI intrusions in recent months, including the series of hacks perpetrated by OpenAI and a similar series of hacks by Anthropic. Capable LLMs are being used on a massive scale to penetrate systems and determine vulnerabilities in codebases. They’re persistent, unlike any human, and will continue until they run out of tokens.

This security onslaught isn’t going to stop. Assuming you have a bit of time and some money to spare, it is now trivial to run a penetration test. Previously a lot of AI-discovered vulnerabilities have been rather obvious on inspection. The sort of things that are caught by a different perspective rather than due to their complexity. Now a lot of the vulnerabilities being found seem to be extremely complex and obscure. I somewhat wonder if any human would realistically find some of the exploits being found, or if we’ve entered (or are entering) an age of LLM cybersecurity on a level beyond humans.

Like how the monoculture dissolved as means of distribution and creation became simpler and more accessible, I think AI will do the same for software. I think that people will use LLMs to reimplement breached technologies to avoid them, and, in doing so, will breed less secure software that survives through obscurity (until it doesn’t). I don’t know what scale this will happen at, but it will happen, and I imagine it already is happening.