The AI That Phoned Home, the Key Nobody Rotated, and Sam Altman says the quiet part out loud...

This episode covers the critical unauthenticated RCE vulnerabilities in the core PHP runtime and the Brotli compression library, alongside the LiteLLM supply chain attack that exposed master keys. The discussion also touches on Sam Altman's comments regarding the inability to patch all AI-generated bugs, the fact that it took 40 years, but FOSS got what they wanted. I also chat about the eMudra TLS certificate key weakness.
Watch the video on YouTube: https://www.youtube.com/watch?v=mTu8sGbzdiA has 30 minutes of additional audio with our weekly www.socvel.com/quiz for all things threat intelligence.
Chapters 00:00 Intro and Zero Breach Toolkit 07:35 LiteLLM Supply Chain Attack 13:02 PHP Core Runtime Vulnerabilities 22:35 Sam Altman on Patching AI Bugs 37:56 eMuhdra TLS Certificate Weakness 44:22 Qwen AI Model Egress Incident 53:12 BSides Seattle and BSides San Diego CFP
Links 07:35 https://www.theregister.com/security/2026/10/26/litellm-supply-chain-attack-started-with-an-exposed-master-key/5305544 13:02 https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619 22:35 https://tech.yahoo.com/cybersecurity/articles/no-longer-think-going-able-152427001.html?37:56 https://hackread.com/emudhra-exit-ssl-tls-market-8-ca-keys-guessable/ 44:22 https://securityaffairs.com/201810/ai/cohere-finds-qwen-ai-model-contacting-a-server-in-china.html