Coder Legion - Recent posts tagged devsecurity

Developer Weekly Briefing — October 23, 2026

Fri, 23 Oct 2026 12:49:47 +0000

Three threads defined this week. Security researchers — now routinely assisted by AI — found critical bugs faster than maintainers could coordinate patches. Agentic AI standards solidified in meaningful ways, with the Agentic AI Foundation adding four new projects and a candid CTO willing to name the gaps. And on the infrastructure side, the tools for keeping developer pipelines safe from compromised packages got sharper. Here's what mattered.

PHP2Shell: AI turned a theoretical bug into an exploit in days

PHP shipped emergency patches on October 21 for PHP2Shell — two critical flaws, both rated 9.2 under CVSS v4.0, that let an unauthenticated attacker run code on your server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If you run a supported branch, the path is simple: patch and restart your PHP workers.

The harder story is what's underneath. These flaws trace back to the PHP 5 series — CVE-2026-109618 corrupts memory during out-of-memory errors, CVE-2026-109619 involves stale global state from freed request memory. Security researchers had spotted the vectors more than a year ago but couldn't find a practical way to trigger them. They stayed in the "theoretical" pile. Then two independent researchers, each using a frontier AI model, found working exploits within days of each other this past August. Cloudflare logged attacks hours before patches shipped on October 21.

Matthew Weier O'Phinney, PHP Foundation board member and principal product manager at Perforce OpenLogic and Zend, was direct: "These vulnerabilities affect every single Server API provided by the language, because their roots are deep within how the engine manages memory." That includes PHP-FPM behind Nginx — not just mod_php. Workarounds like disabling session upload progress buy time; they don't fix the underlying problem.

The real exposure is PHP past community support. Every version before 8.2 is EOL, and 8.2 itself ends community support at year's end. If you're on an older version, your options are a commercial LTS provider — several shipped patches for PHP 7.2–8.1 in coordination with the PHP Security team — or a migration to a supported branch. His broader point: AI is accelerating discovery faster than patches reach unsupported software. That gap is a business risk, not just an engineering footnote.

AAIF now has 10 projects — its CTO on what to adopt and where security falls short

The Agentic AI Foundation started December 2025 with three projects. It hit ten this week at AGNTCon + MCPCon North America in San Jose, adding contributions from Anthropic (Agent Skills), OpenAI (Open Responses), Hugging Face (OpenEnv), and Alibaba (OpenSandbox). The foundation passed 300 member organizations.

I asked Manik Surtani, AAIF's CTO and co-founder, what that means for teams building on these standards. His answers were practical.

On what to use now: MCP and A2A are the most mature. Open Responses has reached solid maturity. OpenSandbox is early but worth watching — and you need a sandbox somewhere. "Running without any sandbox is dangerous, and you shouldn't do it." Put a gateway in the middle so you can migrate models and tools later.

On the reference stack question everyone keeps asking: don't expect one. "The more I think about it, the more I believe any reference stack we build today will be out of date tomorrow." Production deployments are the reference.

On the two biggest security gaps in the agentic stack today: agent identity and authentication, and attestation — proof that an agent did what you asked and didn't go sideways. No AAIF project covers either one yet. There are working groups, but no adopted standards. If your agents operate on real systems, those are the areas where your own controls need to be strongest.

GitHub puts a firewall between npm and your CI runners

Install time is where npm attackers have focused all year. Preinstall and postinstall scripts can run before tests or scanners get a look — the compromised Axios release in March, the @redhat-cloud-services attack in June, and a worm that touched more than 400 packages in August all exploited that window. GitHub's answer is a package firewall, now in public preview for Enterprise Cloud customers.

The firewall sits between endpoints — CI runners, AI coding agents, developer workstations — and the upstream npm registry. Five policy controls ship out of the box: blocking known malware from the GitHub Advisory Database, blocking versions with known vulnerabilities above a configurable severity, blocking attestation downgrades (a package that stops shipping provenance after earlier versions carried it), blocking newly introduced install scripts, and a minimum package age cooldown from 1 to 365 days, defaulting to one day.

The cooldown is the simplest and may be the most useful. Most malicious npm versions are pulled within hours of discovery. A one-day hold would have stopped the compromised Axios versions, which were live for about three hours. The attestation check has a known gap: it won't catch a hijacked pipeline that signs malicious code honestly, as happened in the AsyncAPI attack in July.

Mitch Ashley of The Futurum Group noted the core constraint: "The firewall only protects traffic routed through it, so teams should block direct access to the public registry at the network layer." Watch the metered pricing at general availability too — a usage-based bill gives teams a reason to route less through the firewall.

For Enterprise Cloud customers, the free preview is worth running. Find out what a one-day cooldown would actually catch in your environment before you have to find out the hard way.

Anthropic used Claude to formally verify 123 open source libraries — and found bugs fuzzing had missed

Formal verification has always been expensive. Two person-years to build the seL4 microkernel. Twenty person-years to verify it. That math is why it has mostly lived in avionics and cryptography. Anthropic's Frontier Red Team, working with formal methods company Theorem, ran the largest AI-assisted formal verification effort yet: 123 open source libraries from Google's OSS-Fuzz project, 239 fuzzing entry points, proofs operating on RISC-V assembly, not source code.

The approach was clever. Instead of writing new specs from scratch — historically the hardest part — the team converted existing fuzz tests into formal specs. Each fuzz entry point became a proof statement: this program never crashes on any input under 64 MB. Theorem supplied formal models of RISC-V and Linux process behavior. Claude wrote the proofs. The Rocq proof checker validated them.

Over a few weeks, Claude produced about 180 million lines of Rocq proof. Typical proofs ran around 600,000 lines for a binary with a median of 18,000 instructions. Claude was allowed to patch bugs it hit and keep going, and it found hundreds. Several are notable: a counter underflow in a decompressor that only triggered on inputs around 20 MB with one specific layout; an out-of-bounds read in an image decoder needing a 64 MB input and more than 2 GB of memory; a logic bug in file-loading restrictions that wasn't always enforced. None of these would have surfaced from typical fuzzing, which usually caps inputs at 1 MB.

Cost is real — proofs can consume hundreds of millions of tokens — but Anthropic points to two trends: Claude Opus 5.5 used 40% fewer tokens than Opus 5 on 36 small verification tasks, and agents sharing a workspace and reusing proofs needed 17% fewer tokens. The reuse point matters more than token savings. Much of any proof covers code every C program shares, so proofs transfer well. Verify a small set of widely used libraries once, and much of the stack downstream gets easier.

Anthropic has released a subset of proofs and the RISC-V and OS semantics on GitHub. Theorem is offering to run the pipeline for other open source projects and has published a Claude skill for teams that want to start. The near-term takeaway for DevOps teams: don't drop fuzzing. Do start watching whether formal verification moves into your pipeline the way fuzzing did — Anthropic predicts it will become roughly as practical as fuzzing is today.

GitHub adds AI-powered security scanning to pull requests. GitHub's new code scanning feature runs directly on PRs, flagging security issues before merge rather than after. It uses AI to surface findings in context with the diff. Worth watching if your team uses GitHub Enterprise. Read more
AI agents can now decompile software — here's what that means for security. Researchers demonstrated that frontier AI models can decompile binaries and reconstruct meaningful source-level understanding of proprietary software. The implications run in both directions: useful for security audits, dangerous in the wrong hands. Read more
HiddenLayer puts a security layer between external LLMs and your internal systems. LLM gateway hijacking — where an attacker manipulates prompts to redirect agent calls to a malicious model — is an emerging attack class. HiddenLayer's approach sits in the request path between your application and external model APIs, inspecting and filtering what goes through. Read more
CyberCartel used Claude and Grok to automate banking attacks. A threat actor group documented using frontier AI models to automate credential-harvesting campaigns targeting banking customers. The research maps how they used AI to generate phishing lures, adapt to defenses, and scale operations that would previously have required more manual effort. Read more
Microsoft Foundry agents can now run on a schedule. Scheduled execution is a basic building block for autonomous agents — run a report, check a system, trigger a workflow at a set time without a human in the loop. Microsoft Foundry now supports it natively. Read more
Google launches Harness² for AI agent testing. Google's new testing framework is designed for multi-step agent workflows, where individual unit tests don't capture enough of the failure surface. It's aimed at teams building production agents who need confidence that the full chain — not just each step — behaves as expected. Read more
OpenAI lands a COBOL modernization deal with a Fortune 500 bank. Enterprise AI is starting to move into legacy modernization, one of the largest untapped engineering markets. OpenAI will use its models to translate COBOL systems for a major bank — a deal that signals how AI-assisted migration may finally make the COBOL mountain climbable. Read more
Mod42 is building data centers for organizations that can't afford hyperscale. The hyperscale economics of AI infrastructure don't reach everyone. Mod42's approach targets mid-market enterprise and public-sector workloads that need dedicated capacity without signing a hyperscaler contract. Read more

Developer Spotlight this week

Dean Hall is best known for creating DayZ, one of the most influential survival games of the past decade. He's back with a new project, Brutal, and he rebuilt his game engine from scratch to make it. The conversation covers what drove that decision, where AI fits in his development process, and where it doesn't. His take on what AI still can't do is worth hearing from someone who has shipped at scale.

Watch the conversation

The through-line this week: AI is accelerating both sides of the security equation. PHP2Shell shows how quickly a theoretical bug becomes a working exploit once researchers have capable models to help. The CyberCartel and HiddenLayer stories show the same dynamic at the application layer. And Anthropic's formal verification work shows that AI can also scale up the defenses — producing more proof and catching more bugs than human teams could afford to write by hand. The tools are neutral. The race is real.

See you next Friday.

Developer Weekly Briefing is published every Friday on Coder Legion. Written by Tom Smith.

Keeper Security Closes a Critical Gap in AI-Driven Developer Workflows

Thu, 30 Apr 2026 17:21:31 +0000

AI coding agents are changing how developers work. Tools like Claude Code, Cursor, Codex, and GitHub Copilot can spin up code, configure environments, and interact with infrastructure faster than ever before. But speed without security creates new problems — and one of the most dangerous has been hiding in plain sight.

When a developer asks an AI coding agent to connect to a database or call an API, the agent needs credentials to do it. Until now, the most common approach was to paste those credentials directly into the chat interface. That works, but it also means sensitive API keys and passwords end up stored in third-party logs and, potentially, in AI training data. It's the kind of exposure that can keep a security team up at night.

Keeper Security is addressing that problem head-on with the launch of the Keeper Agent Kit.

What the Keeper Agent Kit Does

The Keeper Agent Kit is a suite of AI skills that connects Keeper's existing security infrastructure — specifically Keeper Secrets Manager and Keeper Commander — directly to AI coding agents. Instead of asking developers to paste credentials into a chat window, the kit instructs agents to retrieve secrets through Keeper's encrypted Command Line Interface (CLI) tools.

The result: the raw credential never appears in the chat UI. The agent resolves the secret at runtime, within the developer's own authenticated session, and the interaction is governed by the same role-based access controls and audit logging that apply to any human user in the system.

There are three core skills in the kit:

keeper-secrets — Handles secure secret retrieval and injects credentials into local runtimes without exposing them in the chat interface.
keeper-admin — Automates vault administration tasks like managing users, teams, and audit resources through Keeper Commander.
keeper-setup — Streamlines the configuration of Keeper's security tools for new projects, getting a secure environment established from the first command.

For teams working in hosted or orchestrated AI environments, Keeper also offers a Model Context Protocol (MCP) server integration — available in Docker and Node configurations — that lets agent platforms retrieve secrets via a running MCP server process rather than relying on local CLI tools.

Why This Matters Right Now

The timing reflects where the industry is. Organizations are embedding agentic AI into their development lifecycles at a rapid pace. The productivity gains are real. But the security gaps that come with it are just as real.

Craig Lurey, CTO and Co-founder of Keeper Security, put it plainly: the Keeper Agent Kit is designed to give AI agents a clear framework for interacting with sensitive enterprise data while keeping Keeper's zero-knowledge standard intact.

That zero-knowledge architecture is worth understanding. It means Keeper itself never has access to your stored secrets — only the end user with the proper authentication can retrieve them. When an AI agent operates through Keeper's CLI tools within an authenticated developer session, that principle holds. The agent gets what it needs to do the job, and nothing more.

Jeremy London, Director of Engineering, AI and Threat Analytics at Keeper Security, framed it well: the goal is to transform AI agents from conversational assistants into secure partners that respect organizational security boundaries. That's a practical and important distinction as more infrastructure work gets handed off to AI.

Open Source and Ready to Use

The Keeper Agent Kit is available now as an open-source repository under the Apache 2.0 license. Developers can access it directly through Keeper Security's official GitHub.

That's a smart move. Making it open source lowers the barrier for adoption and lets the broader developer community inspect, contribute to, and build on the kit. For security tooling in particular, transparency matters.

The Bigger Picture

This launch fits into a broader pattern in enterprise security: the tools are catching up to the workflows. AI is moving fast, and the security infrastructure around it has been lagging behind. Products like the Keeper Agent Kit are part of closing that gap.

For developers already using Keeper, this is a natural extension of what they're already doing. For teams that aren't, it's a practical reason to take a closer look. The ability to let AI agents do their job without handing them the keys to everything is exactly the kind of balance security teams are looking for.

Speed and safety don't have to be trade-offs. The Keeper Agent Kit is a good example of what it looks like when they're not.