GitHub

Security researcher Chris Nesbitt-Smith of ControlPlane used consumer-grade Claude Opus and Sonnet models running on a laptop to scan publicly released UK government code, uncovering over 100 serious vulnerabilities. The most severe case involved the Planning Inspectorate, where Microsoft Entra ID credentials leaked to GitHub retained broad, seemingly non-expiring access to all SharePoint sites and staff OneDrive accounts. The episode shows AI has sharply lowered the barrier to vulnerability discovery, while the real bottleneck is government credential hygiene and remediation capacity.

Goldman Sachs updated internal guidance in October to restrict Anthropic's Claude Code and Microsoft's GitHub to engineers, cutting off traders and bankers who had used the tools to track client flows and build market models. The bank, a lead underwriter on Anthropic's IPO, had already barred Hong Kong bankers from Claude in April.

Security researcher Ariane Djad has published an in-depth technical analysis of PHP2Shell, systematically dissecting the full exploit chain formed by CVE-2026-109618 and CVE-2026-109619, with heap dumps, PoC source code and interactive visualizations released on GitHub. The work fills a gap left by earlier surface-level write-ups and offers direct reference value for securing the PHP ecosystem.