--- title: The Pulse: Time to rethink software security because of AI? description: A cluster of major security incidents hit within days of each other, with AI accelerating both discovery and exploitation of vulnerabilities. eMudhra, a... canonical: https://daily.dev/posts/the-pulse-time-to-rethink-software-security-because-of-ai--gu0kj0fef twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Pulse: Time to rethink software security because of AI? | daily.dev og:description: A cluster of major security incidents hit within days of each other, with AI accelerating both discovery and exploitation of vulnerabilities. eMudhra, a... og:url: https://daily.dev/posts/the-pulse-time-to-rethink-software-security-because-of-ai--gu0kj0fef og:image: https://api.daily.dev/og/posts/gu0Kj0FEF.png og:image:alt: The Pulse: Time to rethink software security because of AI? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Pulse: Time to rethink software security because of AI? **[The Pragmatic Engineer](https://daily.dev/sources/pragmaticengineer)** · 16 min read · 0 upvotes · 0 comments ## Summary A cluster of major security incidents hit within days of each other, with AI accelerating both discovery and exploitation of vulnerabilities. eMudhra, a certificate authority, issued intermediate certificates with private keys as weak as the number '4', costing it 40% of its market value in two days. OpenAI's GPT-5.6 Sol helped find a critical PHP remote code execution flaw, but exploit attempts began before the public patch, with Amazon detecting one four days early via honeypot telemetry. Railway leaked customer environment variables and paused deployments for 20 hours, leaving customers unable to safely rotate secrets. PingCAP's TiDB cloud suffered a month-long breach in which the attacker released 10TB of data that it claimed included customer data from Booking.com and Airbnb, though PingCAP says no customer data stored inside TiDB was accessed. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What caused the eMudhra certificate authority security incident? eMudhra, an intermediate certificate authority, issued certificates with critically weak private keys due to a flaw in its Key Generation Ceremony script. Instead of proper 384-bit random keys, some generated keys were single-digit or small numbers like 4, 56, 66, 115, 156, 230, and 237. Google Chrome said it is evaluating whether to keep trusting eMudhra's remaining CA certificates, and eMudhra's stock lost 40% of its value in two days. _Engineers tracking certificate authority trust failures follow breach breakdowns like this on daily.dev._ ### How was the critical PHP remote code execution vulnerability discovered and exploited? Security team Calif identified the critical PHP flaw using OpenAI's GPT-5.6 Sol model as part of a coordinated disclosure effort, with security company Wiz independently discovering and reporting the same vulnerabilities (tracked as CVE-2026-109618 and CVE-2026-109619). Despite responsible disclosure efforts involving Cloudflare and others, Amazon detected exploitation attempts four days before the public patch was released, and millions of exploit attempts followed within hours of disclosure. _Teams prioritizing patch rollouts for widely used languages like PHP track critical CVEs like this on daily.dev._ ### What happened in the Railway secrets leak and why couldn't customers just rotate their keys? Railway, a developer cloud platform, had an unauthorized third party access encrypted environment variables, with some decrypted, potentially exposing API keys and database credentials. Railway paused all deployments immediately to contain the breach, which meant customers who rotated their secrets could not redeploy to apply the new values, forcing a choice between leaving old keys active or crashing their running applications. The incident took close to 20 hours to resolve before deployments resumed. _Developers weighing cloud platform trust and incident response track breaches like Railway's on daily.dev._ ## Similar posts on daily.dev - [4th May – Threat Intelligence Report](https://daily.dev/posts/4th-may-threat-intelligence-report-o8uni6wf4) · Check Point Research · 0 upvotes · 0 comments - [Security in the age of AI](https://daily.dev/posts/security-in-the-age-of-ai-x8h2ntqmh) · Flavio Copes · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#ai-security](https://daily.dev/tags/ai-security) [View this post on daily.dev](https://daily.dev/posts/the-pulse-time-to-rethink-software-security-because-of-ai--gu0kj0fef) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Pulse: Time to rethink software security because of AI?","url":"https://daily.dev/posts/the-pulse-time-to-rethink-software-security-because-of-ai--gu0kj0fef","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-pulse-time-to-rethink-software-security-because-of-ai--gu0kj0fef"},"datePublished":"2026-10-30T16:49:58.648Z","dateModified":"2026-10-30T17:35:36.473Z","description":"A cluster of major security incidents hit within days of each other, with AI accelerating both discovery and exploitation of vulnerabilities. eMudhra, a...","image":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","thumbnailUrl":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","isAccessibleForFree":true,"articleSection":"The Pragmatic Engineer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Pragmatic Engineer","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/b3ccb8a149434269bda040722d941474","url":"https://daily.dev/sources/pragmaticengineer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-pulse-time-to-rethink-software-security-because-of-ai--gu0kj0fef","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php,ai-security","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Pragmatic Engineer","item":"https://daily.dev/sources/pragmaticengineer"},{"@type":"ListItem","position":3,"name":"The Pulse: Time to rethink software security because of AI?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-pulse-time-to-rethink-software-security-because-of-ai--gu0kj0fef#faq","mainEntity":[{"@type":"Question","name":"What caused the eMudhra certificate authority security incident?","acceptedAnswer":{"@type":"Answer","text":"eMudhra, an intermediate certificate authority, issued certificates with critically weak private keys due to a flaw in its Key Generation Ceremony script. Instead of proper 384-bit random keys, some generated keys were single-digit or small numbers like 4, 56, 66, 115, 156, 230, and 237. Google Chrome said it is evaluating whether to keep trusting eMudhra's remaining CA certificates, and eMudhra's stock lost 40% of its value in two days. Engineers tracking certificate authority trust failures follow breach breakdowns like this on daily.dev."}},{"@type":"Question","name":"How was the critical PHP remote code execution vulnerability discovered and exploited?","acceptedAnswer":{"@type":"Answer","text":"Security team Calif identified the critical PHP flaw using OpenAI's GPT-5.6 Sol model as part of a coordinated disclosure effort, with security company Wiz independently discovering and reporting the same vulnerabilities (tracked as CVE-2026-109618 and CVE-2026-109619). Despite responsible disclosure efforts involving Cloudflare and others, Amazon detected exploitation attempts four days before the public patch was released, and millions of exploit attempts followed within hours of disclosure. Teams prioritizing patch rollouts for widely used languages like PHP track critical CVEs like this on daily.dev."}},{"@type":"Question","name":"What happened in the Railway secrets leak and why couldn't customers just rotate their keys?","acceptedAnswer":{"@type":"Answer","text":"Railway, a developer cloud platform, had an unauthorized third party access encrypted environment variables, with some decrypted, potentially exposing API keys and database credentials. Railway paused all deployments immediately to contain the breach, which meant customers who rotated their secrets could not redeploy to apply the new values, forcing a choice between leaving old keys active or crashing their running applications. The incident took close to 20 hours to resolve before deployments resumed. Developers weighing cloud platform trust and incident response track breaches like Railway's on daily.dev."}}]} ```