RIP Cybersecurity Awareness Month

Carlie at SemgrepOct 30, 2026

October 2026

Cybersecurity Awareness Month gets a headstone, PHP and Node turn up bugs that bite before your code even runs, and agents are cloning everything in sight. Here’s what haunted AppSec this October.

Here Lies Cybersecurity Awareness Month 🪦

Cybersecurity Awareness Month (2004 to 2026). Cause of death: it worked. After 22 years, everybody knows hackers exist, phishing is bad, and reusing passwords is a terrible idea, so Space Rogue spent October making the case for a new name: Cybersecurity Readiness Month. Across four posts, he works through what readiness looks like, from protecting your personal accounts and planning for a lost phone to making sure your organization’s security controls hold up when it counts.

The timing was almost too good. Part Three, on whether your organization is ready, went up on October 21, the same day PHP2Shell and the LiteLLM backdoor landed. Nobody needed a campaign to tell them those were bad. What mattered was knowing where your PHP ran and how fast you could patch it. At that pace, readiness looks a lot like automation: an inventory that stays current on its own, and checks that run before anyone thinks to ask. The final installment picks up where that week left off: what happens after an attacker gets in. We’ve spent two decades teaching people to recognize cybersecurity threats. Maybe it’s time we started teaching them how to survive one.

Catch up on the series: Part One | Part Two | Part Three | Part Four

It Came from the Runtime 🧟

October. So many frights. Browsers rushed to block eight eMudhra certificate authority keys that were weak enough to compute from public certificates, a malicious LiteLLM release reached PyPI and Docker Hub, two remote code execution bugs that had sat in the PHP runtime for over a decade finally came to light, and a day later Node.js got one of its own.

The PHP pair is now called PHP2Shell. If you run Apache with mod_php, any PHP app that receives web requests is exposed before a line of your code runs. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Kurt’s writeup is blunt: patching is the only defense. To test how low the bar is, our research team gave two open-weight models only public information, and both reproduced the RCE for less than the cost of a coffee. A third PHP bug followed two days later, with no patch yet. It only affects an unusual configuration, and setting session.upload_progress.enabled=0, the partial workaround from Kurt’s PHP2Shell post, mitigates it too. If you set it last week, keep it in place while you upgrade.

Node2Shell turned out to be bigger than Node. The bug lives in Google’s Brotli C decoder, which has been copied into runtimes, databases, proxies, and language bindings, including Python’s Brotli package, Bun, .NET, Envoy, and DuckDB. Some already have fixes, and some are still waiting on one. For Node itself, upgrade to 22.23.4, 24.22.1, or 26.12.1. Lewis’s writeup tracks the rest and what to do while you wait.

Isaac summed up the PHP response with a line that got people talking: “If Claude Code is the new us-east-1 (I think it is), your coding agents should know about php2shell before your cloud scanner.” Semgrep Guardian now flags vulnerable PHP and Node versions when an agent starts work on a project. That won’t patch your servers, so patch those first. The replies latched onto one word: deterministic. A rule that gives the same answer every time makes a better gate than asking a second model to check the first one’s work.

Three people asked the same follow-up: does Guardian block the change, or hand the finding back so the agent fixes it? If a developer’s installed PHP is affected, Guardian blocks the agent’s first file write or command of the session to warn them both that it’s exposed to actively exploited vulnerabilities, and prompts an upgrade to a fixed release. Guardian won’t run the upgrade itself, but you can ask your agent to.

The End Is Nigh (for Code Review) 🔮

Daghan’s been carrying a doomsday sign for code review all month, and last week he took it to the Gartner IT Symposium/Xpo stage. His case starts with a Carnegie Mellon and Stanford study of one AI-forward company: pull request (PR) volume grew 3.1x while the reviewer pool grew 1.5x. Reviewers didn’t review harder to keep up. The share of PRs getting any written feedback fell from 39% to 21%, and silent approvals roughly doubled. Even before agents, a separate study found developers doing ordinary review caught seeded security flaws as little as 3% of the time.

His proposal: review every change automatically, let routine changes through when they pass, and send only the consequential ones to a human, with the trade-offs already laid out. We’re piloting this on our own PRs, and the long-term goal is fewer than 1% needing a person. The full writeup has the data and a three-step path for getting there. His line from the stage: “You can’t YOLO at enterprise scale.” Several people found their way to our booth afterward to keep the conversation going. If your team is wrestling with review volume, he wants to hear how.

Who’s Watching the Diff? 🕯️

Your engineers probably didn’t ask before switching coding agents, and they won’t ask before switching again. One engineering leader shared on LinkedIn that his team standardized on a tool they loved, then drifted away from it five months later and ended up split across three. Codex is where a lot of that drifting lands lately, including on our own team, and model quality isn’t the first reason engineers give. They stopped babysitting it. One engineer here does 90% of their work through Codex and has barely touched a terminal in six months.

That autonomy removes the one check that used to happen by default: a human reading the diff. The harnesses are converging, which helps. Claude Code and Codex now use nearly identical hook events, and Cursor covers the same file-edit lifecycle, so a security check can run every time an agent writes a file, whichever tool an engineer picked this month. Jayson’s post digs into why engineers are switching and what the hooks look like under the hood.

Half Treat, Half Trick 🎃

The treat: Claude Opus 5.5 wrote working code on 94% of the 186 real CVE tasks in the SusVibes benchmark. Its 55% correct-and-secure score would top the public leaderboard by about 11 points. The trick: 41% of its working solutions still shipped the original vulnerability. When Dr. Katie dug into the secure ones, more than half matched the project’s real code almost line for line. Opus had no internet or repository access. It was recalling fixes from its training data, and sometimes it recalled the code from before the fix, bug included.

A model that remembers a public fix won’t have that advantage on your private code. On path traversal, memorized solutions were secure 78% of the time, and the ones Opus wrote itself were secure 17% of the time. Across a cluster of weakness types spanning cryptography, concurrency, and authentication, it wrote working code 79% of the time and secure code never. The post closes with five takeaways for teams whose developers lean on coding agents. The first: treat “the tests pass” and “the code is secure” as separate questions.

Invasion of the Software Snatchers 🧬

Everything is getting cloned lately. REA (“Reverse Engineer Anything”), an open-source toolkit that hands decompilers like Ghidra and IDA to AI agents, went from under 10,000 GitHub stars to over 100,000 in about a week. People are using agents to build a clean-room Photoshop recreation and to decompile games that took human teams years. If an agent can rebuild a product in a week, the code alone stops being the moat. Rob Walling’s breakdown of the SaaS moats that survive, from systems of record to network effects, is a good place to start.

When PHP2Shell dropped, our team shipped a check for vulnerable PHP versions the same afternoon. An agent can copy a scanner’s code, but not the team that updates it. Security customers pay for results reliable enough that they don’t have to audit them, and for people who keep them reliable when the next attack lands. Even the skeptics of the clone wave say the copies won’t ship with reliable code security, support services, continued maintenance, and operational improvements built in.

Check the House for Ghosts 🏚️

More teams now host their repositories inside Cursor itself, and the first rule of moving into a new house is to check for anything lurking. Semgrep is now part of Cursor Origin, in beta. Connect once, and every pull request gets scanned for vulnerabilities in your own code, risky dependencies, and exposed credentials. Findings show up as checks and comments in the review your team already uses, with no separate tool to set up afterward.

You can connect from either side, in Semgrep’s source code manager settings or through the Semgrep app in Origin’s marketplace. The announcement has the details.

The Candy Bag Ranking 🍬

Every security practice is a treat. Some are better than others. Here’s how they rank once you dump the bag out on the floor.

King-size bar: phishing-resistant MFA on the accounts that matter. Rare, heavy, and the house everyone talks about the next day.
Full-size bar: a one-week cooldown on new dependency versions. Barely any effort, and it quietly saves your night.
Fun-size: a password manager. Not exciting, but you’ll take a handful.
Homemade popcorn ball: the crypto library someone on your team wrote. It looks impressive, and nobody wants to be the first to bite.
Candy corn: security questions. A few people defend them. Everyone else knows.
Raisins: the annual compliance training video. Technically it counts.
Toothbrush: the 40-page security policy PDF. Good for you in theory. Nobody is happy to get it.

What’s your candy corn? Make your case in Community Slack.

Where We’re Flying 🧹

October’s recordings are up. If you missed Milan and James Berthoty on the rise of citizen developers, or Vasilii testing whether LLMs can find IDORs, both are in the on-demand video library.

Next stop is OWASP Global AppSec USA in San Francisco, November 2 to 6. Find us at booth D3, and catch two of our talks on November 5. One covers turning reluctant developers into AppSec champions. The other walks through cryptographic failures in real-world CVEs, a fitting follow-up to the Opus results above. We’re also hosting Zero Day Off, a community night on the 4th, and All Aboard for AppSec: A Night on the Rails on the 5th. RSVPs are open for both.

Then we head to Europe for BSides Berlin on the 13th (booth and after party), BSides Amsterdam on the 19th, and OWASP Benelux Days on the 26th, with an after party alongside Escape and ArmorCode. We close out November at AWS re:Invent in Las Vegas, starting the 30th.

The full events page has everything else.

Stay Connected 📶

Find us in Community Slack and join the conversation. Curious about Multimodal? Check it out. Community Edition is free forever.