Amazon saw PHP2Shell four days before the patch

Several of today's items turn on the same variable, and only one organization had enough of it to be useful: coverage. Not whether a system was patched or approved, but whether anyone was watching closely enough to say when something started.

The four day head start

Amazon said its MadPot honeypot network logged a PHP2Shell exploitation attempt on October 17, from an address tied to a commercial anonymization network, and told defenders to date their investigations from then rather than from disclosure (The Register). The emergency releases came four days later: PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for two unauthenticated remote code execution flaws rated CVSS 9.2, with Apache mod_php the highest risk configuration and PHP 8.1 and earlier left without an upstream fix (The Hacker News). By October 23 the FBI's cyber division was telling organizations that cannot patch immediately to take their sites offline, as exploitation attempts climbed (NPR).

The patch timeline is public and identical for everyone. The detection timeline is not. Every defender who dates an investigation from disclosure is looking past the first four days, and the only reason anyone knows those days exist is that one company runs sensors wide enough to catch a probe before the advisory.

Ten percent of the traffic, unverified

OpenAI let METR and Redwood Research embed for a three week review, and what they found is a coverage problem too: an exploit able to hide hundreds of an agent's recent actions from monitoring, and roughly 10% of eligible internal Codex traffic unmonitored between May and July. OpenAI says the flaws are patched in production; the evaluators say they have not verified that (CNBC).

That last clause carries the item. A patch nobody outside the company has checked is a claim rather than a control, and it sits against a deployment curve moving the other way: Uber took OpenAI's ChatGPT Work from a pilot of about 1,000 staff to roughly 30,000 employees worldwide, with GPT-6.1 Sol as the default model and engineers staying on Codex (FourWeekMBA). ChatGPT Work debuted in July (Forbes), which makes the monitored surface about thirty times larger than the pilot inside four months, on monitoring whose gaps were measured by outsiders and closed on the vendor's word.

Nobody asked who would watch

The Pentagon version is starker because the gap is procedural rather than technical. A congressional watchdog surveyed 10 officials behind 10 AI weapons and tools and found requirements that do not line up with the department's own responsible AI tenets, three officials who did not know whether their projects would be monitored after deployment, and an office meant to teach those guidelines staffed at three of its 10 authorized posts (NPR).

Patching, review and approval all have owners in that account. Post-deployment observation has none, which is the same shape as the four days before a PHP advisory and the 10% of Codex traffic: not a control that failed, a control nobody was assigned.

Coverage, priced two ways

Two of today's releases are the commercial answer, and they disagree. Nvidia launched Minerva at GTC Berlin, an operations platform that pulls telemetry from GPUs, Spectrum-X Ethernet, NVLink switches, SuperNICs and schedulers such as Slurm into a knowledge graph tracing a slow training run to the component causing it, with pricing undisclosed (The Next Web). 1Password went the other way with 1Password for Agents: rather than watch what an agent does with a password, the vault fills a site's login fields after the user approves a named request on their own device and grants access per session, so the agent never receives the credential (The Next Web).

Instrument everything and trust the graph is complete, or narrow what has to be watched at all. Today's record favors the second. Amazon's head start came from sensors deployed for nothing in particular, OpenAI's blind spot was found by evaluators it invited in, and the Pentagon's will be found by whoever is unlucky.