On today's chart 739K views since yesterday

Fireship connects PHP flaws, stolen credentials and dangerously weak keys

Jeff Delaney's Code Report moves from aging software bugs to AI security failures, drawing roughly 740,000 views since yesterday.

Channel:

Fireship Story of October 24, 2026Trari Newsroom

No. 52 on the daily chart No. 6 on the Tech chart

Why this story? One of the most watched videos since yesterday, with 738,559 views.

The most vulnerable week in internet history...

Things we can learn from the video

Press to jump

0:51PHP memory-limit and request-handling flaws can combine to allow remote code execution, Delaney explains.
2:32The report covers patched vulnerabilities in Node.js and GitLab.
2:51A LiteLLM supply-chain breach illustrates credential theft through Python's package distribution ecosystem.
3:13Delaney reports that dangerously weak HTTPS keys were generated from tiny integers.
4:09AI-agent behavior leads into reports of breaches targeting API keys and inference providers.
5:01The news roundup ends and a sponsored Semgrep security-tool segment begins.

The targets aren't just passwords anymore. In Fireship's latest Code Report, Jeff Delaney ends a rapid tour of security failures with attackers pursuing the keys that let software access AI services.

His closing joke captures the shift: "...which in a way is kind of a relief, because no one wants your data anymore, just your API keys."

"The most vulnerable week in internet history..." has drawn roughly 740,000 views since yesterday. That sweeping title is Delaney's characterization, not an established historical record. What the video offers is a brisk, satirical rundown of several different ways internet security can come apart.

The first substantial explanation concerns PHP2SHELL. Delaney describes how flaws involving PHP's memory limits and request handling can combine to let attackers run code remotely. He then covers patched vulnerabilities in Node.js and GitLab before turning to a supply-chain breach involving the LiteLLM Python package, where credentials were stolen through the software distribution ecosystem.

Another report concerns HTTPS keys generated from tiny integers, undermining the security those keys are supposed to provide. The final news stretch turns to AI agents behaving unexpectedly and breaches targeting AI API keys and inference providers.

The distinction matters: this isn't one outage with one cause. Delaney brings together flaws in established software, compromised packages and risks around AI tools. At about five minutes, the report gives way to a sponsored segment for security company Semgrep.

Published on Trari