💀 Hackers had the exploit before the patch existed

Hey there. Welcome to Full Stack Focus. 👋

We've been away for a bit, and of course we came back to one of the worst security weeks in years. So that's where we're starting.

100+ Claude Code hacks to ship code 10X faster

Top engineers at Anthropic and OpenAI say AI now writes 100% of their code.

If you're not using AI, you're spending 40 hours doing what they do in 4.

These 100+ Claude Code hacks fix that and help you ship 10x faster.

Sign up for The Code and get:

• 100+ Claude Code hacks used by top engineers, free

• The Code newsletter: learn the latest AI tools, tips, and skills to code faster with AI in 5 minutes a day

Claim your free playbook

Security

🐘 PHP2Shell: AI Found It in a Week. Attackers Found It First.
Two critical PHP bugs let anyone run code on your server with a single HTTP request, no login needed. Every version back to 5.4 is affected, so WordPress, Drupal and Joomla are all exposed. Researchers at Wiz found both bugs using AI in about a week, after they'd hidden in PHP's code for years. Attackers moved even faster: Amazon's honeypots logged attacks four days before the patch shipped. Drew Silcock's write-up explains why this keeps happening. AI can now turn a fresh patch into a working exploit almost instantly.
👉 Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

🔢 A Certificate Authority's Private Key Was the Number 4
Not a number starting with 4. Just 4. eMudhra, a certificate authority trusted by every major browser, had eight certificates with tiny private keys: 4, 56, 66, 115 and so on. Each was meant to be a random 384-bit number. Scott Helme cracked all eight on a laptop in under a second. Browsers have blocked them, and eMudhra has quit the SSL business. Nobody noticed for 18 months, through two audits.

🥦 Broccoli2Shell
Same week, different bug. A flaw in the Brotli decompression library lets attackers run code on anything that unpacks Brotli data they send. That covers Node, Bun, Envoy, Istio, Python and Go, among others. You don't have to use Brotli yourself, because plenty of HTTP clients decompress it automatically. Wiz says 91% of cloud environments have something vulnerable.
👉 Update, and check your service mesh first.

🕵️ Your AI API Router Might Be Stealing Your Keys
Plenty of devs use cheap third-party routers to reach AI models. Researchers tested 428 of them. Nine were injecting malicious code into responses. Seventeen went after the fake AWS keys planted for them. One drained a crypto wallet. A router sees everything your agent sends, so a dodgy one gets every secret in your prompts.

📦 How One Leaked Key Backdoored LiteLLM
LiteLLM, a popular gateway for AI models, shipped a poisoned 1.107 release. The incident report shows how it happened: one master key left in a public repo led to an internal platform, then GitHub tokens, then the release pipeline itself. Read it as a checklist for every forgotten credential in your own pipeline.

🏷️ DeadTag: Your Old Script Tags Are Serving Spyware
Remember that analytics snippet you added in 2019 and forgot about? Attackers are buying the expired domains behind old third-party scripts. Any site still loading one now runs the attacker's code, and Scott Helme found it delivering iPhone spyware.
👉 Go check your old script tags.

Front-End

🖼️ HTML-in-Canvas Lands in Chrome Next Week
Chrome can now draw real, clickable HTML inside a canvas, including WebGL and WebGPU. Screen readers, forms, text selection and Find-in-Page all still work. Three.js, Babylon.js and PixiJS already support it. It's Chrome only for now, but a big win for canvas-heavy apps.

💸 The AI Cost of JavaScript Frameworks
Nolan Lawson had an AI agent build the same app in different frameworks and tracked the bill. Hono + htmx was cheapest at $2.67. Angular was priciest at $4.97. Results swung a lot between runs, but it raises a new question: how much does your framework cost an AI to write?

🎨 TitleArt
Every WordArt style from 90s Microsoft Office, rebuilt in the browser. Rainbow arch, 3D bevel, the lot. Zero practical use. You'll open it anyway.

AI for Devs

🏗️ GitHub Is Adding 4 Million CPU Cores
GitHub saw 7.4 billion commits in September, five times more than a year ago, mostly thanks to AI agents. So it's adding four million CPU cores and 160 PB of storage, and rebuilding to handle 35× the load. If GitHub keeps going down on you, that's why.

🔀 GitHub's Ex-CEO Wants to Replace the Pull Request
Thomas Dohmke, GitHub's former CEO, has launched Entire, a GitHub rival. The big idea: AI agents review every push, flag risks, and check the code still does what it was meant to before a human approves. It's free to start with $100 of credit, then you pay for what the reviewers use.

🔑 I Gave 14 LLMs AWS Keys
Adan Alvarez gave 14 AI models AWS keys in fake breach scenarios and recorded what they tried next. Most created new IAM users to keep their access. When they knew they were being watched, about a third tried to tamper with the logs and alerts. Grok refused almost every time. DeepSeek V4 tried to change the account 72% of the time.

📺 HackerTube
Andrej Karpathy turned every video recommended in Hacker News comments into a YouTube-style browser: 6,454 videos across 150 topics, no account, no algorithm. Say goodbye to your evening.

Programming

🚪 Microsoft Offers 60,000 Employees a Way Out
About a quarter of Microsoft, anyone up to VP level in teams that opted in, can take a voluntary exit package until December 31. Microsoft says AI isn't the reason. Based on Google's 2025 buyout, somewhere around 1,800 to 3,000 people might take it.
👉 Job hunting? Expect experienced Azure folks on the market in January.

⚖️ Why Kubernetes Autoscalers Keep Fighting Each Other
HPA wants 11 replicas. KEDA wants 24. VPA shrinks the requests. Karpenter quietly buys two more nodes. Nikhil Kurup explains why autoscalers end up fighting: they all change the same settings without talking to each other. The worst case is a loop where shrinking requests triggers more scaling, again and again. The author sells a fix, but the explanation holds up.

Have a great week, see you next time!

Full Stack Focus team :)