AI Security: Unfixable Hardware Bugs, Chinese Hacker Using AI, CVE in Brotli
Three converging security stories: OpenAI insiders warn of unfixable hardware bugs exploitable by AI speaking machine code; a low-budget Chinese hacker used AI to breach John Deere and others; a critical Brotli memory bug (CVE-2026-111497) affects Node.js, Python, and Envoy.
What we know
The most viral AI security signal comes from an account on X (9,926 likes), quoting OpenAI insiders who claim there are 'unfixable bugs in hardware that are exploitable by AI models directly speaking machine code,' suggesting software fixes alone are insufficient. Separately, another account on X RT'd reporting on a low-budget lone-wolf Chinese hacker who used AI to compromise multiple companies including John Deere — distinct from ongoing state-sponsored campaigns. On the software side, another account on X flagged CVE-2026-111497 (Node2Shell) in Brotli, a transitive dependency in Node.js, Python, Envoy and system libs that most teams don't know they're running, warning that 1,000x more agentic tokens will make this attack surface nearly impossible to manage.
How the story developed
Three converging security stories: OpenAI insiders warn of unfixable hardware bugs exploitable by AI speaking machine code; a low-budget Chinese hacker used AI to breach John Deere and others; a critical Brotli memory bug (CVE-2026-111497) affects Node.js, Python, and Envoy.
A new unpatched PHP RCE vulnerability (CVE-2026-115560) dropped just two days after emergency patches for PHP2Shell flaws, while Cloudflare's CEO warns we're entering years of weekly sky-is-falling security events.
Two critical unauthenticated remote code execution vulnerabilities in PHP went public before patches were available, affecting WordPress, MediaWiki, Magento, Joomla and Laravel. Cybersecurity stocks including PANW and ZS moved higher as the broader tech sector fell.
A PHP zero-day enabling unauthenticated RCE on WordPress, Joomla, Laravel and more leaked before a patch was available, kicking off what multiple observers are calling the worst 48 hours in cybersecurity history, with AI agent swarms and a CVSS 10.0 GitLab flaw compounding the crisis.
A critical PHP remote code execution vulnerability (#php2shell) leaked before patches were available, affecting WordPress, Joomla, Laravel and more. Cloudflare's CEO reported exploit attempts scaling from thousands to millions within hours. A separate high-severity Node.js Brotli decoder RCE was also disclosed simultaneously.
Critical PHP vulnerabilities affecting ~70% of websites and 4 high-severity Node.js flaws patched today are generating significant alarm, though some outside the tech bubble are dismissing the PHP scare as 'AI slop.'
The NSA issued an emergency warning about two critical PHP vulnerabilities giving direct filesystem access, discovered by AI. Node.js was patched the same day for 4 high-severity flaws, prompting a cybersecurity stock buying thesis.
By the Global Eye 24 desk, with AI assistance. Updated as the story develops. Spot an error? Write to corrections@globaleye24.com.