The Commoner

Thursday, October 22, 2026

Sup, freaks.

AI helped find a longstanding flaw in code used across much of the web, and the attackers piled in.

WHAT TO EXPECT IN THIS NEWSLETTER

• AI helped find PHP2Shell, a longstanding flaw in a language used across much of the web. Cloudflare saw exploit attempts hit the millions within a day.
• 2026 has already produced 21.7% of every CVE ever published, and attackers are hunting AI keys.
• A security checklist for the weekend, and a woman facing prison over a Cash App account she says she never opened.
• The OCC drops its stablecoin yield presumption, Fidelity touts perpetual preferreds and a JPMorgan chart shared by Milk Road shows a 280 GW compute gap.
• Bitcoin Core 32.0 is tagged. Wait for the signed binaries.

Marty's Bent

AI Found the Bug. Then It Leaked

Yesterday I told you to patch PHP and moved on to the next item. I undersold it. To be fair to myself, it was still a developing story when we hit send, but we have a lot more context this morning and it's clear that PHP2Shell is the biggest security story of the year so far. So let's dive in.

PHP is the language running under the hood of 69.3% of all websites whose server-side language W3Techs can identify; WordPress, Drupal, Joomla, Wikipedia, you name it. Wiz, the Google-owned cloud security firm, published its technical writeup yesterday and it is not pretty. Every unpatched PHP release going back to version 5.4, more than a decade of software, is affected by at least one of the bugs, which are grouped under two CVEs with severity scores as high as 9.2 out of 10. Wiz showed an attacker taking over WordPress, Drupal and Joomla sites without even logging in. Their words, not mine: "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history."

The disclosure didn't go to plan either. The PHP Foundation intended to announce later this month alongside a complete fix, but details leaked on social media Tuesday, according to the BBC, and that forced everyone's hand. Cloudflare CEO Matthew Prince shared what his network saw: thousands of exploit attempts in the 10 hours before the announcement, tens of thousands in the 45 minutes after it, hundreds of thousands within two hours, "and millions now." Wikimedia took systems offline as a precaution, the Dutch public health institute pulled its website, the NSA told organizations that can't patch to take their systems offline and the White House says federal agencies are working with the leading AI labs to speed up a fix. And PHP wasn't the only fire. Node.js shipped security releases yesterday fixing four high-severity bugs, including a remote code execution flaw in its Brotli decoder that was reported by OpenAI's Codex Security team.

What really gets me is how this stuff is being found. Wiz says it found the first PHP bug on August 19 using its own Atlas tool alongside Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. A security group called Calif found it independently with GPT-5.6 Sol, according to The Verge, and the BBC reports that came through an OpenAI program called Patch the Planet, with an OpenAI researcher finding it around the same time. The flaws had been sitting there for years, but Wiz says proving they could be exploited "required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier." Once they had the bug, the models helped Wiz build working exploits across multiple applications "in hours." Then this line, which anyone who runs anything connected to the internet should tape to their monitor: "complexity may no longer provide a meaningful barrier."

For decades a lot of software stayed safe largely because breaking it was too hard and too expensive to be worth anybody's time. That protection is wearing thin fast, and the same tools that help the good guys find the holes help the bad guys walk right through them. Don't believe me? Look at the numbers. Lisa Neigut pointed out this morning that "we're well on track to have 25% of all CVEs reported in this year alone." I pulled the data behind the tracker she linked. There have been 394,368 published CVEs, the public IDs assigned to known security flaws, since the system started. 85,490 of them were published in 2026. That's 21.7% of every CVE ever with ten weeks left in the year. All of 2025 produced 48,151, about 4,000 a month. This September alone did 14,934. To be fair, a CVE count measures how many bugs get found and reported, not how many get written, and changes in who files them move the numbers too. Still, the monthly pace more than tripled in a year right as AI bug hunting took off. I'd bet AI scanning is a big driver, even if it isn't the only one.

Is any of this really surprising though? Bitcoiners have been living in this world since late July and early August, when the reported Coldcard-linked wallet drains, Boltz pausing swaps and the BTCPay Server emergency hit in quick succession and the Bitcoin Red Team spun up AI-assisted reviews across hundreds of repositories. We said then that it was only a matter of time before this came for the rest of the web. Well, it's here. Spiral's Loupe scanner has already sent more than 20,000 AI-generated findings to bitcoin projects, as we covered yesterday, Bitcoin Core alone has fielded more than 1,000 reports from the scanning flood and Bitcoin Core tagged version 32.0 yesterday with "Anthropic Security" listed in the credits. Meanwhile, the attackers know exactly what they want. Also yesterday, the cloud platform Railway disclosed that an unauthorized party may have accessed customers' encrypted environment variables and, for some of them, got the decrypted contents, which is where API keys and database passwords live. Railway believes it's "part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers." Compute is the scarce resource of the moment and people are breaking into everything to get at it.

Now for some commentary, and I want to be clear that what follows is my opinion and my speculation. I have been warning about a "cyber pandemic" since October 2021, after the World Economic Forum spent 2020 and early 2021 telling anyone who would listen that one was coming. Here is Klaus Schwab in his opening remarks at Cyber Polygon 2020: "The COVID-19 crisis would be seen in this respect as a small disturbance in comparison to a major cyber attack." Last night I tweeted that the cyber pandemic is here. I don't want to get too conspiratorial, but I would be shocked if governments didn't know about some of these holes for a long time and weren't taking advantage of them. Let's not forget that WannaCry, the ransomware that tore across the world in 2017, was built on exploits stolen from the NSA. Governments stockpiling holes is not a theory. If you were sitting on a stockpile of holes like these, now would look like a pretty convenient moment to use them. Look at the backdrop. We're less than two weeks out from the midterms. Iran's security chiefs threatened today to hit oil facilities, undersea cables, datacenters and AI facilities across as many as seven Gulf countries if the US and Israel attack again. Zelensky said yesterday Ukraine will support trilateral peace talks with the US and Russia and told Fox News he's open to freezing the front lines. There are a lot of variables up in the air at the same time, and the chaos introduced by AI-driven exploits landing right in the middle of all of it is very coincidental. Or maybe it isn't coincidental. Either way, the timing is very, very interesting.

Most normies have no idea this is going on right now. Your antennae should be raised. It's time to mentally prepare for the propaganda onslaught that will inevitably follow, because this is a perfect setup for a Hegelian dialectic. The problem is a web full of holes that machines can now find in hours. The reaction is fear. The solution, you can bet, will be pitched as more control over the internet by governments and their trusted corporate partners; digital ID to get online, permission slips to run models and only approved companies allowed anywhere near the frontier. Don't think the rails for this aren't being laid as we speak. Sam Altman's World, the company with the iris-scanning orb, announced on Sunday that Zoom and financial firms including Bain Capital and VanEck are adopting its "proof of human" badges. Individuals must resist these calls aggressively. Open-source software and open-weight models that anyone can download and run are what keep defense from becoming a permissioned activity, and we need to make sure they stay available to everyone before a digital ID system gets rushed on us in the name of safety. Sovereignty and individual freedom in the digital age depend on it.

There is a silver lining here, though. These flaws have been sitting in PHP's code for years. It's a good thing they're getting found and patched now. Yes, people are going to get hurt, and who knows how long it will take to patch everything or how many forgotten servers are out there that will stay exposed forever. But these tools cut both ways. Maybe some white hats go out there with DeepSeek or other open-weight models and start patching servers that haven't been touched in years. It would be legally murky, but in some setups the same access that lets you run code on an unpatched server might let you patch it too.

We're in the chaos now and we just have to live with that reality. Patch your stuff, take responsibility for your own security, which is the deal bitcoin has always offered, and defend against any attempt to use this moment to strip away freedom and liberty in the digital age.

Be aware, freaks.

SIGNAL

Do this checklist before the weekend

Peter Wildeford posted a short checklist yesterday in light of this week's attacks, and it's the best one I've seen. Use a password manager and never reuse passwords. Turn on two-factor authentication for everything important, and not by text message. Use an authenticator app or, better, a hardware security key. Leave auto-updates on and restart weekly so they actually install. Freeze your credit. Get an IRS Identity Protection PIN to help stop fraudulent tax returns filed in your name. Call your carrier and set a port-out PIN or number lock to make it harder for someone to steal your phone number. That last one matters more for bitcoiners than almost anything else on the list, because a hijacked phone number can compromise accounts that rely on text messages for login codes or recovery. I'd add one more. If you hold real bitcoin, the keys shouldn't live on a computer or phone that touches the internet all day.

Someone opened a Cash App in her name. Now she faces prison

404 Media's Joseph Cox reports that Amanda Smith was arrested in upstate Pennsylvania in April on an Arkansas computer fraud warrant, a state she says she's never visited. She spent three nights in jail. A scammer had tricked someone on Facebook Marketplace into sending $1,000 to a Cash App account opened with her Social Security number and birthday. She says she's never used Cash App, and Kyle Torpey notes the phone, IP, device and address details don't match her. She faces up to six years in prison. Cash App won't give her information about the account because she can't prove she owns it. As Kyle put it: "Her personal info was good enough to open the account, but not good enough to access it in the future, apparently." He adds that Cash App is likely just following the law. That's the problem. A stolen Social Security number and birthday were enough to open the account, and the person they belong to is the one paying the price. Disclosure: Block, which owns Cash App, sponsors this newsletter.

The OCC drops its stablecoin yield presumption

The OCC finalized its rule implementing the GENIUS Act yesterday, and the detail worth watching is buried in the rule itself. The law bars stablecoin issuers from paying holders interest or yield solely for holding, using or retaining the coin. The OCC's draft went further, with a "rebuttable presumption" that certain deals between an issuer and its affiliates or related third parties broke that ban. Many commenters wanted it tougher. The final rule drops it. The yield ban stays, and so does the OCC's power to go after evasion, but it won't start from the presumption that rewards paid through affiliates and partners break the law. The rule and the GENIUS Act take effect January 18, 2027, and the anti-money laundering and sanctions rules are coming separately with Treasury. Banks have every reason to hate this, because a dollar earning rewards in a stablecoin is a dollar that might otherwise sit in a checking account paying close to nothing. Competition for deposits is a good thing. Just remember it's still a dollar, and inflation keeps eating it.

Fidelity calls perpetual preferreds a new source of demand

Fidelity Digital Assets published a report calling perpetual preferred stock the newest demand catalyst for bitcoin. Companies sell yield-hungry investors preferred shares and buy bitcoin with the cash. Fidelity says the products had helped accumulate 135,979 bitcoin as of October 5, more than 0.5% of the total supply. It also notes the model "only works if the appreciation of the underlying asset outpaces the cost of yield." Strategy's latest 8-K shows that from October 12 to 18 it sold zero preferreds under its ATM programs and spent $193.1 million of existing cash buying back 1,938,780 STRC shares. On October 19 it lifted its buyback authorization to $3 billion. It bought 267 bitcoin that week, funded almost entirely by common stock. STRC's November rate is slated at 12% a year if shareholders approve daily dividends, with bitcoin down about a third from its high above $125,000. My read: when bitcoin outruns the coupon, savers' money flows into bitcoin. When it doesn't, issuance dries up and cash can go to buybacks, like last week.

A JPMorgan chart via Milk Road shows a 280 GW compute gap

A J.P. Morgan forecast making the rounds via Milk Road AI puts global AI compute demand at roughly 530 gigawatts by 2031, against projected supply of about 250 gigawatts. That's a 280 gigawatt gap, up from roughly 50 gigawatts today, even with supply expected to roughly quadruple from 2025. I haven't seen the underlying J.P. Morgan report, so treat the exact figures as the bank's projection as relayed by Milk Road. The direction lines up with everything else we've been covering, from SpaceX and Anthropic's compute spending to the hunt for AI keys in today's lead. My read: the constraint isn't customers. It's chips, electricity, buildings and how fast they come online. That's the world bitcoin miners already live in. They've spent years hunting for cheap power, building sites and running hardware at full load. Network hashrate sits around 1,033 exahashes per second this morning. If this forecast is even close, the power miners control should only get more valuable, and the competition for it fiercer.

⚡ FREEDOM TECH CORNER

DATA SNAPSHOT

Spot price, block height and hashrate estimate: October 22, 2026, 9:39 a.m. ET. Bitcoin Lab daily series: October 21, 2026. U.S. spot ETF flows: October 21, 2026.

Sources: Kraken spot quote, mempool.space block height and hashrate, Bitcoin Lab daily metrics, and TFTC ETF flows. Daily metrics use the provider’s October 21 observation, not live intraday estimates.

Talk tomorrow, freaks.

Marty Bent · TFTC · Nostr

YouTube

Podcast