Blog & Insights — ScriptWalker

2026.05.04 · 562 views

They Patched It on April 19. It Was Exploited by April 21. CVE-2026-42208 in LiteLLM Is the Cleanest Lesson in Modern AppSec This Year.

A pre-authentication SQL injection in the LiteLLM proxy's API-key check leaked virtual API keys, stored provider credentials, and the proxy's environment variables. CVSS 9.3. First in-the-wild exploitation: ~36 hours after public disclosure. Every line of the post-mortem hits the four pillars — input validation, authn/authz, third-party packages, and CIA — at the same time.

Microsoft Agent 365 Just Went GA — and Quietly Made Claude Code, Copilot CLI, and OpenClaw All Subjects of the Same Identity System

AI & Automation

2026.05.04 · 737 views

Microsoft Agent 365 Just Went GA — and Quietly Made Claude Code, Copilot CLI, and OpenClaw All Subjects of the Same Identity System

On May 1, 2026, the "control plane for agents" left private preview. Each AI agent now gets its own Entra identity, Purview labels, Defender runtime governance, and Intune device management — for $15/user/month, or rolled into the new Microsoft 365 E7 Frontier Suite at $99.

Mago 1.0 Lands — A Rust-Powered PHP Toolchain Just Made composer require Embarrassed

Web Development

2026.05.04 · 564 views

Mago 1.0 Lands — A Rust-Powered PHP Toolchain Just Made composer require Embarrassed

After 12 alphas, 34 betas, and 13 release candidates, the first stable cut of carthage-software/mago combines linter, formatter, and static analyzer into one binary that benchmarks roughly 10x faster than PHPStan — and Laravel News is calling it "the biggest PHP tooling shift since Composer."

1.5 Million cPanel Servers Owned by 12 Bytes of CRLF: Anatomy of CVE-2026-41940

Cybersecurity

2026.05.03 · 570 views

1.5 Million cPanel Servers Owned by 12 Bytes of CRLF: Anatomy of CVE-2026-41940

When Input Validation, Session Storage, and the CIA Triad All Failed at Once — and What Every PHP Hosting Project Should Audit Tonight

Claude Code Auto Mode Goes GA: 30-to-60-Minute Unattended Coding Is Now Normal

AI & Automation

2026.05.03 · 1,026 views

Claude Code Auto Mode Goes GA: 30-to-60-Minute Unattended Coding Is Now Normal

Why Headless --print, GitHub Actions, and "Just Walk Away" Are Reshaping the PHP / App Developer's Daily Loop

Tempest 3.0 Lands With PHP 8.5-Only and a CSRF Defense You Don't Have to Code

Web Development

2026.05.03 · 555 views

Tempest 3.0 Lands With PHP 8.5-Only and a CSRF Defense You Don't Have to Code

How Brent Roose's New Framework Quietly Replaced the Anti-CSRF Token With Two HTTP Headers — and Why That Matters for Your Next PHP Project

The First Supply-Chain Worm to Weaponize Claude Code: Inside the SAP npm "Mini Shai-Hulud" Attack

Cybersecurity

2026.05.02 · 1,106 views

The First Supply-Chain Worm to Weaponize Claude Code: Inside the SAP npm "Mini Shai-Hulud" Attack

April 29's compromise of four official SAP packages used .claude/settings.json and .vscode/tasks.json for persistence. OWASP A03 just got teeth.

93% of Developers Use AI. Productivity Is Up 10%. Welcome to the 2026 AI Paradox

AI & Automation

2026.05.02 · 643 views

93% of Developers Use AI. Productivity Is Up 10%. Welcome to the 2026 AI Paradox

AI now writes 41% of all code, security vulnerabilities are up 23.7%, and delivery velocity has barely moved. Here is where the value is leaking — and how to plug it.

Why "CLAUDE.md" Became GitHub's Most Forked File of 2026 — and What PHP Teams Should Steal From It

Web Development

2026.05.02 · 669 views

Why "CLAUDE.md" Became GitHub's Most Forked File of 2026 — and What PHP Teams Should Steal From It

A 101k-star single-file repo, a 175k-star agentic skills framework, and the new shape of project documentation for the agent era