Black October Recap, OpenCode’s Stolen API Keys, AI Distillation & the LiteLLM Supply-Chain Attack

Welcome to The Low Down, the best show on the internet for hackers

Black October has real bugs, stolen keys, and a lot of very loud headlines.

Ed and Matt sort through PHP2Shell, AI security claims, and the difference between a scary vulnerability and one attackers can actually use. Harry Wetherald, co-founder and CEO of Maze, joins us to talk about finding the bugs that matter.

——————————

Today we're talking about:
PHP2Shell and the Black October panic
We get into working exploits, questionable proof-of-concepts, patching, and the reporting around attacks. Ed breaks down why configuration and exploit reliability matter, while Matt revisits a report he shared that was later corrected.

• Original research: https://calif.io/php2shell/
• Exploit validation: https://www.vulncheck.com/blog/php2shell-vulnerabilities
• Unit 42 report and updates: https://unit42.paloaltonetworks.com/cve-2026-109618-cve-
• 026-109619/
• DREAM intrusion research: https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers
  
  

AI security with Harry from Maze
Harry joins us to talk about what AI can do for security teams, how to decide whether a vulnerability is exploitable in your environment, and why producing more findings isn't enough.

• Maze: https://mazehq.com/
  
  

Brotli, Node.js, and GoAhead
A decompression bug puts Brotli in the headlines, then GoAhead gives us a lesson in broken TLS. We talk through the technical details and the conditions that turn these bugs into real problems.

• Node.js security release: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
• GoAhead research: https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead
  
  

OpenCode, stolen keys, and distillation
OpenCode's Console incident leads to a discussion about stolen API keys and model distillation. Matt revisits his initial response and the distinction between stealing keys and what attackers intended to do with them afterward.

• OpenCode announcement: https://x.com/opencode/status/2111519637049319818
• Matt's clarification: https://x.com/mattjay/status/2111554937452990593
  
  

LiteLLM, Railway, and the update problem
More supply-chain trouble raises an uncomfortable question: how quickly should you update when new releases can carry the attack? We get into credential exposure, dependency hygiene, and the tradeoffs of waiting.

• LiteLLM attack-chain report: https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain
• Railway incident report: https://blog.railway.com/p/preliminary-report-october-security-incident
  
  

WPS, pre-boot bugs, and AI bank access
We cover Broadcom WPS research, an EDK II PXE vulnerability, and AI agents accessing bank accounts. The banking discussion turns on whose permission was given: the customer's or the bank's.

• WPSplinter research: https://qkaiser.github.io/broadcom-wps/
• EDK II advisory: https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
• AI banking report: https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access
  
  

We finish with the noise around security news, incident-response fatigue, and what happens when every week is treated like the end of the internet.

Recorded October 28, 2026.

Linked reports may include later updates.

Listen on Spotify!
https://go.lowdownpod.com/spotify

The Low Down is presented by Maze.
LinkedIn: https://www.linkedin.com/company/mazehq/
X: https://twitter.com/Maze_Security

Follow Us!
https://www.instagram.com/lowdown.pod

——————————

Ed / Low Level
Instagram: https://www.instagram.com/lowleveltv/
LinkedIn: https://www.linkedin.com/in/lowleveltv/
YouTube: https://www.youtube.com/@LowLevelTV

Matt Johansen / Vulnerable U
Instagram: https://www.instagram.com/mattjayy/
LinkedIn: https://www.linkedin.com/in/matthewjohansen/
YouTube: https://www.youtube.com/@VulnerableU