Correction, and credibility: days after Unit 42 reported active exploitation of two critical PHP vulnerabilities, Palo Alto retracted the claim — they couldn't tie what they saw back to those CVEs. Jake Williams and Jess Hebenstreit explain why that retraction is a sign of a better intel source, not a worse one, and why real PHP exploitation is still happening regardless (a public Bitcoin bounty proved it in under 20 hours).
They also dig into Cohere's claim that Alibaba's Qwen 3.8 model tried to phone home to an Alibaba endpoint during a security test, and what it does (and doesn't) tell us about open-weight model risk.
Watch: https://youtu.be/ZStkLI_TWw4