Summary
Riley Brown sits down with developer Ange Nanda to unpack what they call the most alarming week in AI-era cybersecurity. The conversation covers a critical PHP vulnerability that gave attackers root access to server files, prompting the FBI and NSA to urge operators to patch or take applications offline, along with bugs in Node.js and GitLab.
A central thread is the role of AI in making attacks cheap. The guests discuss how DeepSeek V4.1 Flash, an inexpensive and capable coding model, lowered the cost of finding and exploiting flaws, and how attackers targeted infrastructure providers such as Railway and OpenCode to steal API keys and AI credits for resale. Nanda shares firsthand experience of API key abuse at Vibe Code, which lost roughly $100,000 to exploiters.
The pair also highlight an irony in the response: when OpenCode was under attack, US models such as GPT-6 Astra reportedly refused to help investigate because of cybersecurity safeguards, leaving defenders to rely on the same open-source models used against them. The discussion touches on API key limits and whether labs should give trusted companies access to stronger models for defense.
📺 Source: Riley Brown · Published October 26, 2026
🏷️ Format: Interview
