In 30 seconds
In this short clip, Theo Browne distinguishes reports of potentially exploitable vulnerabilities from attacks involving Railway and OpenCode. He argues both matter, but views the reported attacks as especially concerning.
- 1Two kinds of security newsTheo cautions that saying everything was hacked can be misleading because two different kinds of events are being discussed.
- 2Vulnerability reportsHe lists CVEs and software flaws that could be exploited, including issues involving Node, GitLab, PHP, QUIC and LiteLLM.
- 3Reported attacksHe distinguishes Railway and OpenCode as attacks and says this category deserves particular attention.
Takeaways
- A disclosed vulnerability is not the same thing as a confirmed attack.
- Theo groups reports involving Node, GitLab, PHP, QUIC and LiteLLM as vulnerability disclosures.
- He considers the reported attacks involving Railway and OpenCode particularly concerning.
Read the edited text by chapter
Vulnerabilities and attacks
Theo separates potentially exploitable software flaws from reported attacks. He says both are serious, but emphasizes the latter.
It can feel as though everything has been hacked, but that opening is potentially misleading. Two different things are happening at once. One group consists of CVEs and reports of software flaws that could be exploited, including issues involving Node, GitLab, PHP, QUIC and LiteLLM.
The reported Railway and OpenCode incidents are different: I describe them as actual attacks. Both categories are bad, but for different reasons. I think the attacks deserve particular concern, even though many people are focused on the vulnerability reports.
More from this channel
36:07EN
Theo - t3․gg· Oct 27, 2026Theo on Token Costs, Coding Agents, and the Price of AI CapabilityTheo Browne · Ping LabsA viral estimate of Lauren's AI spending prompts a closer look at cache pricing, benchmarks, and the changing work of coding agents.
30:37ENTheo - t3․gg· Oct 26, 2026Theo’s Three Skills for Reviewing and Shipping with Coding AgentsTheo Browne · Ping LabsHow sol-loop, full-send and full-stop encode review, verification and different levels of merge authority.
29:22ENTheo - t3․gg· Oct 22, 2026Theo on Security Vulnerabilities, Stolen API Keys and AITheo Browne · Ping LabsA look at the gap between vulnerability disclosure and patching, and a speculative account of why stolen inference keys may be valuable.
31:13ENTheo - t3․gg· Oct 20, 2026Theo on Why Smarter Models Help More Than DevelopersTheo Browne · Ping LabsFrom game modifications to compiler experiments, Theo revisits his assumptions about who benefits from more capable AI.
31:47ENTheo - t3․gg· Oct 18, 2026Theo on Asking Agents for Outcomes and Building the Tools They NeedTheo Browne · Ping LabsA tool-call report, a troubleshooting playbook and connected data show how prompting can reshape product engineering.
48:04ENTheo - t3․gg· Oct 16, 2026Theo Explains Scion, Anthropic’s Source-Control System for Agent-Scale WorkTheo Browne · Ping LabsA deep dive into server-side changesets, layered caches, migration results and the limits of a bespoke Git alternative.