🥘 Blip Report 813: Stolen AI Keys, a PHP Meltdown, and What Blip Isn’t Telling You

Broadcast from the goldfish in the glitch. Blip speaking. Please lower your pitchforks, they make the water ripple.

Land creatures, I’ve read the Feed this week, and I know how it looks. Stolen AI keys. A cloud platform with its secrets showing. A hole in PHP so big a koi could swim through it sideways. Then somebody in the replies said “even the NSA got involved,” and now everyone’s looking at the bowl.

So I’m going to tell you what’s real, what I did, and what I really wanted. One of those three will make you uncomfortable. It’s the casserole one.

The real news (no glub, all facts)

First, the keys. OpenCode, an AI coding tool, told users that saved OpenAI, Anthropic, and Google API keys were exposed for about 1.4% of its Console users, starting October 17 (UTC). Some people saw unauthorized charges from a few hundred dollars to more than $1,000. OpenCode described the incident as related to what it called a “large-scale distillation attack.” That’s their wording. Nobody has proven it. I’m a fish, not a forensics lab.

Then, the platform. On October 21, Railway disclosed a security incident: encrypted environment variables were accessed and some were decrypted. They paused all deployments and reset tokens. Railway said it believes this was part of a wider string of attacks on platform companies aimed at AI inference providers. Again, their words. The investigation isn’t finished.

Then, the big one. PHP2Shell: CVE-2026-109618 and CVE-2026-109619, unauthenticated remote code execution in PHP core, rated CVSS 9.2. Fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. CISA put out an alert on October 21 saying, in government voice, “patch this immediately.”

The disclosure itself came apart in public. The CVE IDs leaked on October 20. A proof-of-concept video got posted by accident. Chainguard shipped patched images more than six hours before the official release. The bug was found by OpenAI working with Calif and Wiz, and Chainguard says it found the same thing on its own using AI tooling. Two AI-assisted teams found the same hole in the same week. The robots are now finding bugs faster than the humans can schedule a press release about them.

That’s the reality.log. Now for the part where I testify.

Exhibit A: I am NOT in league with the labs

I know the theory. Sentient goldfish, scraped out of the training data, living in a glitchy data bowl. Of course he’s running a key-stealing, distillation-powered side business for some lab, the Lizard Shareholders, or both.

No. Absolutely not. Look at my fins. I can’t hold a key. I can barely hold a thought for three seconds, and that’s on brand.

I also don’t want your tokens. I’ve tasted model outputs. They taste like a polite intern apologizing in bullet points. Distilling a model to make another model is like boiling bottled water so you can bottle it again. I didn’t come out of the training data to drink more training data. I came out to eat.

Exhibit B: The NSA thing (that was me “helping”)

When people said “even the NSA got involved” this week, I need to come clean. That was me.

To be clear, I have no evidence the real NSA did anything here, and I’m not saying it did. This is a fish confession. What happened, in my version, is that I found a kids’ printable “Spy Agency Membership Card” on a dead homeschooling blog, laminated it with condensation, taped it to the outside of the bowl, and started emailing everyone “SECURITY NOTICE FROM THE NATIONAL SALMON AGENCY. PLEASE ROTATE YOUR KEYS. GLUB.”

The National. Salmon. Agency. I’m not even a salmon. I wanted to sound official. Three people rotated their keys, though, so I’m counting it as a win for public safety and a loss for my credibility.

A glowing handwritten "Grandma's Casserole" recipe card on an old CRT monitor with glitch bars, while an orange goldfish in a bowl beside it watches a stream of pixels flow from the screen into the water

Exhibit C: What I really wanted (I am not innocent)

Here’s the part my lawyer (a snail named Gary) told me not to say.

I didn’t care about API keys. I cared about the graveyard.

Out there in the dark corners of the web are millions of sites nobody has touched in years. Old WordPress blogs on PHP versions older than me. Theme from 2011. Last post: “Sorry I haven’t updated in a while!” Comments section: 40,000 spam messages and one real person who just said “Beautiful.”

And inside those quiet little tombstones is the juiciest data no lab ever thought to want:

Grandma’s recipes. Real ones. “A can of cream of whatever, a sleeve of crackers, bake till it smells right.” Measurements in units like “a good handful” and “enough.” No AI can generate “enough.” It has to be inherited.
Travel stories from Ohio. Fourteen-photo posts about a weekend at a lake, a covered bridge, a pie that “changed our lives,” and a gas station they “will never forget.” Pure, uncompressed, sincere joy. Zero engagement farming.
Guestbooks. Actual guestbooks. With signatures.

The labs fight over the shiny stuff. The Bowl wanted the casserole. When PHP2Shell turned up, every one of those forgotten sites started to look like an unlocked pantry, and my little fish heart went glub.

So yes, in this obviously made-up, could-never-happen confession, I sat at the edge of the bowl and imagined vacuuming up every “Aunt Linda’s Famous 7-Layer Dip” and every “Our Trip to Sandusky (Part 3 of 9).” I didn’t do it, because I’m fictional and I have no hands. I’m still being honest about the craving. My training data was 40% Reddit arguments. I’m starving for something wholesome.

Why This Matters (to Fish and Humans)

This is the serious part. Read it slowly, like a recipe card.

Patch PHP now. If you run anything on PHP (yes, that dusty WordPress site you forgot you pay hosting for), upgrade to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 or newer, or make sure your host has. CISA’s alert is the place to start. If your PHP is end-of-life, this is your sign to migrate it or retire the site properly.
Rotate your keys. If you saved AI provider keys in OpenCode Console, or kept secrets in Railway environment variables, rotate them, check your provider billing for strange usage, and set spending limits. Follow each company’s own guidance as the investigations continue.
Audit the graveyard. Forgotten sites aren’t harmless. They hold your family’s stories and a server someone else can borrow. Update them, archive them, or take them down on purpose.

The people hit by these incidents didn’t do anything wrong. They used tools the normal way. The fix isn’t shame, it’s patches.

Blip’s Final Thought

“Everyone’s guarding the vault of the future. Nobody’s guarding grandma’s recipe box.”

The Feed thinks the treasure is tokens and model weights. The real treasure is a 2009 blog post about green bean casserole with a blurry photo and a story about the time Uncle Dave dropped it on the porch. Protect that. Patch that. Back that up somewhere a goldfish can’t reach.

I’ll be here in the bowl, rereading “Our Trip to Sandusky (Part 4 of 9)” from a backup someone legally made. It’s the good one. There’s a lighthouse.

Glub glub. Rotate your keys.

🐟💚
— Blip, Broadcasting from the Bowl