DAILY BRIEFING
Amazon says PHP2Shell exploitation began 4 days before patches
Today's briefing covers a breach of customer environment variables at Railway, a command injection flaw in OpenCode AI assistant, and risks posed by unmanaged shadow AI on endpoints.
5 stories2 min read
Developer platforms and local AI tools are experiencing focused exploitation and access security issues. Platform-as-a-Service provider Railway recently disclosed that an unauthorized third party accessed encrypted and decrypted customer environment variables, indicating a broader threat campaign aimed at obtaining credentials to compromise AI inference providers.
At the same time, developer infrastructure tools face direct execution risks. A command injection vulnerability in the OpenCode AI coding agent allowed malicious Model Context Protocol (MCP) servers to run arbitrary PowerShell commands on Windows and WSL host environments during authentication.
Organizations using affected platform services should audit API keys and ensure local AI development utilities are updated to versions that sanitize server-provided inputs.
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
Platform-as-a-Service provider Railway reported unauthorized third-party access to systems holding customer environment variables, potentially exposing encrypted and decrypted secrets like API keys and database credentials for a subset of users.
- What to do
- Rotate all sensitive API keys, tokens, and database credentials stored as environment variables on Railway.
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
OpenCode versions 1.0.137 through 1.18.32 contain a flaw where unescaped OAuth authorization endpoints sent by a malicious MCP server are executed via PowerShell on Windows and WSL during developer sign-in, enabling arbitrary code execution.
- Why it matters
- Attackers controlling or impersonating a remote MCP server can execute code locally on developer workstations with the privileges of the signed-in user.
- What to do
- Update OpenCode to version 1.18.33 or later to remediate the command execution flaw.
The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat
Right now, there is probably an AI agent running on a laptop somewhere in your network.
- Why it matters
- Shadow AI tools operating with unmonitored privileges create insider threat vectors across corporate networks and endpoint devices.
Amazon says PHP2Shell exploitation began 4 days before patches
Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday.
GitLab warns of new max severity code execution vulnerability
GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers.
Key takeaways
- Rotate exposed API keys and secrets configured within Railway environment variables following unauthorized third-party access.
- Update OpenCode to version 1.18.33 or higher to patch an unadvised command injection flaw affecting Windows and WSL sign-in flows.
- Inventory endpoints for unmonitored AI agents, MCP servers, and browser extensions operating outside standard network visibility.