Before we get into this week's Daily, a quick word from our sponsor: Shortform

Okay now back to our regularly-scheduled CFOing:

...Well that was an interesting week!

In what much of the security world is calling “Black October,” last week brought a slew of bug-tastrophies and breaches that essentially demonstrated exactly how much has changed in our risk posture thanks to AI.

What happened?

First on Tuesday, a bug discovery and disclosure that combined the speed of AI with the clumsiness that is our current bug disclosure process...

​Patch the Planet, an AI hacking-for-good project led by OpenAI and others (including my first CFO startup alma mater, Trail of Bits), discovered a pair of bugs in an extremely prevalent tool, PHP. The bugs are now nicknamed “PHP2Shell.”

PHP is essential infrastructure that holds up a lot of things on the internet:

WordPress, Wikipedia, online stores, government services, banks. In total, it runs about 70% of websites.

So this was a pretty big deal.

Unfortunately, as is typical with good-guy bug disclosures, there’s an ideal process and a clumsier actual process that often happens.

Ideal process: The good hackers disclose the bug to the tool owner so they can patch the issue and deploy it in an update on the base software before it’s discovered by the bad guys.

Unfortunately this time, it leaked.

And then, to make matters worse, a security company called Chainguard tried to be helpful and released a patch before the bug was even officially disclosed.

But unfortunately the patch revealed the actual bug to hackers, who were able to do a whole bunch of bad stuff faster than the patch could be implemented by PHP (since the patch wasn’t in the official software update... it was just a public release for Chainguard's own software packages... 😬)

Yep, I know.

Security people are very smart, but we don’t always have our sh!t together.

On top of this disaster, last week saw a slew of new breaches to be aware of:

• ConnectWise Cloud Backup (Microsoft 365 backups, often run by your IT provider): Microsoft tied the breach to a China-aligned group that used an AI hacking agent to attempt sign-ins to 2,250+ Microsoft 365 tenants.
• Railway (cloud app platform): Hackers decrypted some customer secrets, and Railway told all users to rotate their keys.
• OpenCode (AI coding tool): Attackers stole stored AI keys and ran up users’ OpenAI, Anthropic and Google bills, some over $1,000.
• LiteLLM (AI gateway software): A poisoned release stole passwords, cloud logins and AI keys. Attackers were testing the stolen cloud credentials within hours.
• GitLab (self-hosted code repositories): A maximum-severity flaw affects every self-managed version back to 2014.
• eMudhra / emSign certificates: A website security certificate provider generated its keys so weakly that one of them was the number 4. If your website uses an emSign certificate, it needs replacing. Chrome stops trusting it today.
• Also: Capcom (11.7M gaming accounts) and ETS (millions of California student records).

If you use any of that software, contact your IT team, update your software, rotate your keys, and check your email for messaging directly from the company on what additional actions to take.

(Just please don’t follow any email directions blindly. Breach disclosures are prime phishing attack moments, so make sure security directives are legitimate.)

As I saw the news rolling out this week I felt my fingers itching.

As many of you know, I’m working on an AI Security Briefing Newsletter to provide regular news updates on breaches, research, code/policy changes, and the latest best practices for finance teams.

This would have been a REALLY good week to launch!

But then I reflect:

They’re all going to be good weeks to launch this.

Why?

Because we’re in a new paradigm here.

AI is finding bugs faster, exploiting them in minutes, propagating attacks in hours, and completely changing the landscape of how safe we are in our digital lives.

Staying secure isn’t about checkboxes anymore. It’s going to require ongoing vigilance.

So back I go to my little security CFO nerd cave.

Let’s get that info drip started!

Your Daily CFO,

Lauren