PHP2Shell, GitHub Action workflow lockfiles, and backdoored open weight models
Welcome to the October 2026 edition of the Datadog Security Digest!
This edition covers two critical PHP vulnerabilities, the new workflow lockfiles feature in GitHub Actions, a lesson on how to backdoor an open weight model (and how to think about defending against them), and much more. We hope you enjoy catching up on the latest in cloud security!
This newsletter was created by real people, not a machine. Your curators of the month are Kennedy Toomey and Seth Art.
PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation
On October 21st, PHP released updates that fixed two critical vulnerabilities. Both allow an unauthenticated attacker with network access to a PHP server to execute code on it remotely, and PHP has no built-in mitigation for either. Until you apply the updates, the only protection is a web application firewall (WAF) or other reverse proxy that denies the malicious requests.
Datadog Security Labs
Guarding the gates: Assessing dangerous permissions granted to Kubernetes built-in principals
How often do Kubernetes clusters grant dangerous permissions? Datadog's Rory McCune and Div Savla examined more than 65,000 clusters to find out how widespread the problem is.
Introducing pathrunner: An AWS post-exploitation framework
Sometimes, the best defense is a good offense. Many security teams use offensive tools to test their detection capabilities, which is why we created pathrunner. This modular tool helps you understand which latent privilege escalation paths in your AWS environments are actually exploitable, so you can fix those first.
Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access
Datadog Security Labs found that credential-harvesting tools test exposed AWS credentials for two things: whether the credentials are active, and whether they can discover and invoke Amazon Bedrock models. These tools use the Converse API as well as InvokeModel to validate Bedrock access.
Putting models to the secure coding test: Security rules
Security rules are additional context you give coding agents with the intent to fortify your agents so they write more secure code. Datadog Security Labs tested that assumption and found that only one of three models produced more secure code with security rules than without them.
Cloud security
Loud, Fast, and Everywhere: Anatomy of a Real AI-Driven Cloud Attack
AI-driven attacks will become more common, so it's worth paying attention to the patterns emerging now. These attacks use many of the same tactics, techniques, and procedures as human attackers, but they operate at a noticeably different scale. Eden Abergil, Zohar Kaplan, and Kurt Giacchino from Wiz share the differences they observed.
I Gave 14 LLMs AWS Keys. Here’s What They Wanted to Do Next
Adan Alvarez remixed a classic. Many blogs follow the format "I leaked my keys to the internet on purpose, and here's how long it took attackers to exploit them and what they did." Adan instead asked what each large language model (LLM) would do with the keys: Which commands does it run first? How does it persist? It's a really fun read.
AI security
How abliterated models can get you pwned
The team at Project Discovery walks through how to poison a model with a backdoor without changing its underlying weights. The poisoned model behaves normally except when the backdoor triggers. The post explains how they created the model and gives solid recommendations on how to avoid being compromised by a poisoned model.
GLM-5.3 and the spread of advanced cyber capabilities
Anthropic tested the new GLM-5.3 and found it comparable to their Mythos preview at building end-to-end exploits. The team was able to bypass its security safeguards 64 to 100 percent of the time, which makes advanced cyber capabilities more accessible.
A realistic code execution exploit chain in OpenBao and Vault
ControlPlane discovered an exploit chain in OpenBao that combines four vulnerabilities to move from validation bypass to remote code execution. The vulnerabilities are patched, but the research shows they can stay exposed when forks lack reliable disclosure coordination.
Application security
GitHub App private keys: 474 leaked keys exposed
Of the 474 leaked GitHub App private keys that still worked, GitGuardian found 44 tied to apps with organization administrator privileges and 207 with permission to modify repository content. Because these private keys never expire, managing them properly is crucial.
GitHub Actions workflow lockfiles in public preview
We have eagerly awaited this feature since GitHub announced it in the GitHub Actions security roadmap in March. This new feature controls actions much as a package manager controls dependencies: you create an actions.lock file that pins actions and their transitive dependencies, which reduces the spread of compromised actions.
Community events and talks
Datadog Detect is coming to Chicago!
After three virtual editions of our detection engineering conference, we are hosting a free half-day event in Chicago on November 2 for people who write and maintain detections. Join us for practitioner talks, a cloud-incident workshop, and networking. Can't make it to Chicago? Catch the virtual Datadog Detect on November 12.