Colby

Patching is the hardest step for agents to get right. We took what we learned from hundreds of Patch the Planet patches, thousands of internal Codex sessions, and a decade of fix reviews, and built it into two open-source agent plugins. A good fix looks different in every codebase, and building one takes judgment and expertise. Our plugins encode best practices that work for our engineers so you can patch along at home. •patching-bugs makes an agent prove each fix: the original code fails, the patched code passes, and a full revert fails again. •regression-hunt checks what else the change broke, with a live proof of concept for every regression it reports. Both work best with a THREAT_MODEL.md and patching guidelines, so agents know what your project considers a bug, a regression, and an acceptable fix. They fit naturally in loops like @OpenAI's new Daybreak Defense Factory, where agents draft patches for people to review. blog.trailofbits.com/2026/10…

We achieved RCE via Brotli in Linux labs: • Node.js 24.22.0 + Express 5.3.0 (x86-64/ARM64) through its standard JSON parser • Electron 41.10.7 (x86-64) using a custom-built decoding service Getting it to work requires a carefully matched setup and can take repeated attempts.

Our demo shows PHP2Shell giving a shell on MediaWiki, Symfony, Laravel, and phpBB. We’ve confirmed exploits work on pre-patch releases of PHP 8.2–8.5. If you haven’t updated, assume attackers can compromise your server, and that exploitation will only get easier.

We’re still testing how exploitable the Node.js/Brotli bug is, but we’ve found that it’s surprisingly hard to tell whether you’re even affected. So @ToBScottA built a scanner that finds hidden copies of the decoder, even in stripped binaries. github.com/trailofbits/brotl…

“You want to find the bugs, but it’s only good if you can also fix them.”—@anishrnaik on Risky Biz. Many open-source projects have only a handful of maintainers, and fixes are falling behind. We’re building a reusable toolkit to help. Full pod: youtube.com/watch?v=6SIgPjQ9…

Yesterday, rumors started circulating about two unpatched critical-severity bugs in PHP. Within 17 hours, Cloudflare was blocking attacks and Patchstack reported active exploitation. When AI can develop a working exploit in hours, bugs need to be patched just as fast. Each day without a fix carries the risk that an attacker will find and exploit the bug. But it takes time to create a working patch, and PHP's patch was more complex than most. The patch changed 402 files and added more than 11,000 lines, reworking core engine behavior that dozens of extensions depended on. The bug was reported on Aug 11, and fixes were shipped 71 days later. But less than a day after details leaked, systems running PHP were already under attack. Patching needs to keep up with the pace of bug discovery. For the past four months, we’ve worked directly with open-source projects as part of Patch the Planet to understand how AI can expedite patching. Our ongoing research and work show that project-specific documentation, skills, and plugins can be embedded at the repo level to give agents and contributors access to the context maintainers carry in their heads: what counts as a bug, how a fix should look, and what can't break. Our two new open-source plugins, patching-bugs and regression-hunt, are a first step toward a generalized set of tools and guidance for getting a working patch out faster: blog.trailofbits.com/2026/10… PHP’s account of the incident: thephp.foundation/blog/2026/…