Welcome to The Low Down, the best show on the internet for hackers Black October has real bugs, stolen keys, and a lot of very loud headlines. Ed and Matt sort through PHP2Shell, AI security claims, and the difference between a scary vulnerability and one attackers can actually use. Harry Wetherald, co-founder and CEO of Maze, joins us to talk about finding the bugs that matter. —————————— Today we're talking about: PHP2Shell and the Black October panic We get into working exploits, questionable proof-of-concepts, patching, and the reporting around attacks. Ed breaks down why configuration and exploit reliability matter, while Matt revisits a report he shared that was later corrected. Original research: https://calif.io/php2shell/ Exploit validation: https://www.vulncheck.com/blog/php2shell-vulnerabilities Unit 42 report and updates: https://unit42.paloaltonetworks.com/cve-2026-109618-cve- 026-109619/ DREAM intrusion research: https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers AI security with Harry from Maze Harry joins us to talk about what AI can do for security teams, how to decide whether a vulnerability is exploitable in your environment, and why producing more findings isn't enough. Maze: https://mazehq.com/ Brotli, Node.js, and GoAhead A decompression bug puts Brotli in the headlines, then GoAhead gives us a lesson in broken TLS. We talk through the technical details and the conditions that turn these bugs into real problems. Node.js security release: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases GoAhead research: https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead OpenCode, stolen keys, and distillation OpenCode's Console incident leads to a discussion about stolen API keys and model distillation. Matt revisits his initial response and the distinction between stealing keys and what attackers intended to do with them afterward. OpenCode announcement: https://x.com/opencode/status/2111519637049319818 Matt's clarification: https://x.com/mattjay/status/2111554937452990593 LiteLLM, Railway, and the update problem More supply-chain trouble raises an uncomfortable question: how quickly should you update when new releases can carry the attack? We get into credential exposure, dependency hygiene, and the tradeoffs of waiting. LiteLLM attack-chain report: https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain Railway incident report: https://blog.railway.com/p/preliminary-report-october-security-incident WPS, pre-boot bugs, and AI bank access We cover Broadcom WPS research, an EDK II PXE vulnerability, and AI agents accessing bank accounts. The banking discussion turns on whose permission was given: the customer's or the bank's. WPSplinter research: https://qkaiser.github.io/broadcom-wps/ EDK II advisory: https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m AI banking report: https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access We finish with the noise around security news, incident-response fatigue, and what happens when every week is treated like the end of the internet. Recorded October 28, 2026. Linked reports may include later updates. Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod —————————— Ed / Low Level Instagram: https://www.instagram.com/lowleveltv/ LinkedIn: https://www.linkedin.com/in/lowleveltv/ YouTube: https://www.youtube.com/@LowLevelTV Matt Johansen / Vulnerable U Instagram: https://www.instagram.com/mattjayy/ LinkedIn: https://www.linkedin.com/in/matthewjohansen/ YouTube: https://www.youtube.com/@VulnerableU
