Three big hacks hit developers in the same week this month. Most people I talk to lump them together. They shouldn't.
Two of them wanted one thing, your AI API keys. The third one wanted your whole server.
The two that wanted your keys
OpenCode went first. Around October 17, someone got into an old system behind OpenCode Console. That's the optional hosted part of the tool, and some users had saved their AI provider keys there. About 1.4% of users had keys exposed, and some woke up to surprise Anthropic and Google Cloud bills.
Railway was next. Railway hosts apps. On October 21 it said attackers may have read customers' environment variables. That's where your app keeps its secrets, like database passwords and API keys. Its upper estimate is about 100,000 workspaces, and it told every single user to change every key.
Railway says the attack was aimed at AI providers, and OpenCode's breach was tied to the same kind of attack. A stolen key lets you run OpenAI or Anthropic models while someone else pays. The likely plan was distillation. That means asking a big model huge numbers of questions and training your own model on the answers.
So these two were about your wallet. Nobody touched your code. They went after a company you trusted to hold your keys, because one break-in there gets them thousands of keys at once.
The one that wanted your server
PHP2Shell is a different problem. Nobody broke into a company here.
Two bugs in PHP itself let anyone run code on a server without a password. PHP runs about 70% of the web. That includes WordPress and Drupal sites, and even the admin pages on some routers and firewalls.
Here the target is the whole machine.
The odd part is that AI was on the defending side this time. The security firm Calif found one of the bugs while working with OpenAI, using its AI tools. Wiz reported the second. Then the details got out early, and Amazon says attackers were already using the bugs before the fix shipped on October 21.
The simple version
OpenCode and Railway were keys stolen from the key cabinet. PHP2Shell was a broken lock on millions of front doors.
The two stories do meet, though. If your PHP server keeps your OpenAI key in a .env file, PHP2Shell can reach that key too. A broken lock can still end in a stolen key.
What I'd do today if you ship AI apps
- Change every key you've stored on a third-party platform. Start with your AI provider keys.
- Set a hard spending limit on every AI provider account, because a stolen key with no limit means a bill with no limit.
- Use one key per project, so one leak doesn't take everything down.
- Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on anything that still runs it. On WordPress? Ask your host.