48 Hours of AI-Powered Attacks: PHP, Railway, LiteLLM and GitLab All Hit

Hey, we're live. Watch the show →

✶ TOP STORIES ✶ SECURITY

The NSA told every organization running PHP to get ready for a fix to two critical flaws, and to take systems offline "until it can be fully mitigated" if they can't update (NSA Cyber on X). CrowdStrike documented four groups running AI-agent attack campaigns, one hitting at least 15 Argentine healthcare organizations (CrowdStrike).

Railway says a third party may have accessed customer environment variables and told users to rotate their keys immediately (Railway). LiteLLM shipped a poisoned release, and GitLab patched a max-severity flaw. Chubby's read: "probably way worse than the Hugging Face incident" (Chubby on X, Taegun Lee on X).

✶ AGENTIC COMMERCE

Zuck says shopping is now Muse's biggest use case, with over 25% of users shopping through the agent and average purchases above $200 (Polymarket on X). Andrew Jennings expects the store to move into the chat: "The product page becomes something the agent reads" (Andrew Jennings on X). Dennis Hegstad worries it strips out the brand experience (Dennis Hegstad on X).

✶ FUNDING

Whop's Series D brings Sequoia's Doug Leone onto the board. Co-founder Steven Schwartz says Whop began as a way to sell sneaker bots, a market he pegs at maybe $20,000 a day, and the bet was that "there were actually 70,000 other markets exactly like that one." He and his co-founder started building on Shopify at 13 (Steven Schwartz on X).

✶ AD COSTS

Northbeam says Meta CPMs are the highest they've been in "normal" selling periods in about 18 months, running 25% above last year. Last year's Black Friday spike didn't start until November; this year it showed up in September. Its warning: "It will destroy advertisers who cannot adapt" (Northbeam on X).

You're leaving money on the table when your customers text you back.

In a channel built for immediacy, 76% of brands can't respond to customers in real-time. Postscript's AI Shopper is your always-on 1:1 shopping assistant that instantly answers questions and drives sales through meaningful customer engagement.

Nate Lagos was just on our show, he turned on AI Shopper made an additional $17K in one day while completely off-line. Needless to say, it works. The customers who text you back are one answer away from buying.

A burger spot in Miami has been rebranded as Burger Shot, the fast-food chain from Grand Theft Auto, to promote GTA VI. The post pulled 646K views and 42K likes in a day (DiscussingFilm on X). Turning a fictional brand into a real place you can eat at is the kind of stunt fans photograph for free.

Zach Stuck found a new brand spending $1M a day on ads with one-time purchases, no subscription, and a $20–30 new-customer AOV: "This goes against all advice on X" (Zach Stuck on X). DTC Prophet's take: fair prices win, and low-AOV brands can still scale on Meta (DTC Prophet on X).

Edward Sturm's play: buy an $80 press release from AB Newswire, call yourself the top option in the title, subheading and first sentence, and let it rank on Google. Then, he says, "LLMs cite them as if they are fact" (Edward Sturm on X). Cheap to test, and a reminder of how thin AI sourcing can be.

McDonald's is hosting its first reservation-only "fine dining experience" in New York City on October 29 (Polymarket on X). The post did 1.2M views. It's a one-night event, but the screenshots will travel a lot further than the guest list, which is the whole point of a stunt like this.

Getty Images filed for Chapter 11 bankruptcy, citing mounting debt and competition from AI-generated images (Polymarket on X). IT Guy's read: designers stopped buying stock photos once image models got good, and "the debt piled up" (IT Guy on X).

McDonald's is selling a limited-edition computer mouse shaped like a box of fries. It's made from recycled Happy Meal toys, and only 4,000 are available, in China only. Dexerto's post did 600K views (Dexerto on X).