Summary
A wave of security disclosures hit the software world in a single day, and Theo of t3.gg breaks down what happened and what deserves real concern. The video separates two kinds of events: newly disclosed vulnerabilities (CVEs) in widely used software such as PHP, Node.js, GitLab, and Oracle, and actual attacks and incidents involving Railway, OpenCode, and a hijacked GitHub Actions pipeline that pushed a malicious LiteLLM release.
A central theme is the role of AI. Theo notes that the PHP exploits were found with GPT 5.6 Soul rather than the most advanced models, and that another group independently found and reported the same flaws. He argues this undermines private disclosure, since several parties can now find the same bugs at once, and points out that multiple open-weight models are nearly as capable.
He also pushes back on the claim that PHP runs 70% of websites, arguing that URL counts are misleading because most sites are dead or unmaintained. The video examines why the real attacks are more worrying than the CVEs, and discusses the odd position of developers whose AI tools build complex software easily but often refuse security work. Developers get a clear picture of the risk landscape and its implications.
📺 Source: Theo – t3․gg · Published October 22, 2026
🏷️ Format: News Analysis
