> WHO HOLDS
THE KEYS?▮

For two years the phrase "sovereign AI" has mostly lived in slide decks. On Thursday, October 29, it got a price tag. Prime Minister Mark Carney stood up in Montréal and announced that the Government of Canada will make an equity investment of up to $1.6 billion in Cohere,^1,7 the Toronto-founded company that builds large language models and enterprise AI systems for businesses and governments.

This is not a grant. Ottawa is framing it as a commercial investment, made alongside private money from NVIDIA, Bell and Germany's Schwarz Group, and paid out in stages. In return, the government gets an ownership stake and a set of conditions that read like a sovereignty checklist.¹

What Cohere signed up for

According to the Prime Minister's Office, Cohere has committed to:

• Create at least 1,000 new high-paying technical jobs in Canada by 2030.
• Spend at least $1.7 billion on additional computing infrastructure in Canada by 2030.
• Keep its Canadian incorporation and Canadian headquarters.
• Invest in Canadian research partnerships and student opportunities.
• Keep working with the Canadian AI Safety Institute.¹

Cohere also has to report regularly on progress against those jobs and investment commitments, and the money is released in tranches. The release also notes that Cohere recently merged with Germany's Aleph Alpha, which gives the company a European foothold to go with its Canadian one.¹

Why now

The Cohere deal is the biggest move yet in a busy month for federal AI policy. On October 2, Carney launched a new National Council on Artificial Intelligence under the AI for All strategy that Ottawa first announced in June.⁸ On October 13, AI Minister Evan Solomon opened another $500 million over five years for the Regional Artificial Intelligence Initiative, bringing that program to $700 million in total.² That money flows through the regional development agencies to help ordinary businesses adopt AI, not just build it.

Put those together and the shape of the policy becomes clear: fund adoption at the bottom, back a national champion at the top, and tie both to the idea that Canadians should have a credible, Canadian-controlled option.

The part the press release doesn't answer

Here's what I'd want any CIO to sit with before rewriting their AI roadmap.

First, the release doesn't say whether federal departments will actually use Cohere. It says the investment gives Canadian businesses and governments more choice. Choice is good. It isn't a procurement commitment, and it isn't a guarantee of lower prices or better models.

Second, sovereignty is more than geography. A model hosted in a Canadian data centre is a start, but buyers should also ask who holds the encryption keys, which country's laws can compel access to the data, where support staff sit, and where model updates are trained. Those questions apply just as much to the big U.S. hyperscalers as they do to Cohere.

Third, there's a real debate about whether national control translates into public accountability. An October 26 essay in Open Canada argued that a Canadian-controlled AI system can reduce dependence on foreign infrastructure without making automated decisions any easier for citizens to understand or contest.⁹ On the other side of the aisle, Conservative MP Leslyn Lewis wrote in The Hill Times on October 28 that Canada needs its own capacity rather than relying on systems shaped in the U.S. or China.¹⁰ Both arguments can be true at once, and both are worth reading.

What this means if you buy AI for a living

If you run IT for a Canadian organization, nothing about Thursday's announcement forces a switch. It does give you new leverage. Sovereignty is now an explicit federal priority with money behind it, which means "where does our data live and who can reach it" is a fair question to put to every AI vendor at renewal.

A practical approach for the next quarter:

1. Map your sensitive workloads. Separate the AI use cases that touch personal, health, financial or government data from the ones that don't. Only the first group needs a sovereignty conversation.
2. Write residency into contracts, not just architecture diagrams. Ask for data-location commitments, key ownership, and breach-notification timelines in writing.
3. Keep a second model in reserve. Whether it's Cohere, an open-weight model on your own hardware, or a Canadian-region deployment from a hyperscaler, a tested fallback is your best protection against price changes, outages or policy shifts.
4. Watch the Regional AI Initiative. If you're a small or mid-sized business in Southern Ontario, FedDev Ontario is one of the agencies delivering that $700 million. Adoption funding is often easier to win than research funding.

Every so often a vulnerability lands that isn't in an app or a plugin, but in the plumbing that runs a huge share of the web. PHP2Shell is one of those. If your company website, intranet, customer portal or WordPress site runs on PHP, which is most of the small-business web and a large share of shared hosting, you need to confirm it has been patched.

What happened

On October 21, the PHP project shipped emergency, out-of-cycle releases to fix two critical remote code execution flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell." The PHP team scored both at 9.2 on the CVSS 4.0 scale.^4,12

• CVE-2026-109618 abuses the way PHP handles running out of memory. A carefully built request can leave PHP's internal data in a half-filled state, which attackers can turn into code execution.
• CVE-2026-109619 is a use-after-free bug in PHP's upload-progress feature, the code that tracks file uploads.¹³

The detail that makes this nasty: both bugs trigger while PHP is parsing an incoming multipart form, before any of your own application code runs. Security firm GuidePoint put it plainly in its advisory: the parsing layer itself is the attack surface. A single unauthenticated request can be enough.^13,14

The timeline went sideways

According to a timeline published by Hostinger, researchers at the security firm Calif found the first flaw on August 1 while working under OpenAI's "Patch the Planet" initiative, and reported it to PHP on August 11. The plan was a coordinated release. Then, on October 20, the CVE numbers leaked before technical details were published, an exploit video was briefly posted and pulled, and a Hacker News post claiming to describe the bug was taken down.⁵

BleepingComputer reported that Amazon's threat intelligence team saw attackers targeting the flaws four days before patches shipped. CISA has since confirmed exploitation and ordered U.S. federal agencies to patch.¹¹ The Hacker News reported on October 28 that a suspected China-linked group used an AI-assisted PHP2Shell exploit chain, paired with a Linux privilege-escalation bug, to root 25 servers on October 25, including three in a U.S. government-affiliated environment.⁶

Dark Reading compared the moment to Log4Shell, the Java logging bug that sent the industry scrambling nearly five years ago.¹⁵ Tenable gave PHP2Shell its highest internal rating.¹⁶

Which versions are fixed

The fixed upstream releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Anything older on those branches is exposed.¹²

The harder news is for anyone running PHP 8.1 or earlier. Those branches are end-of-life, and there will be no official fix.¹³ If a legacy site is still on PHP 7.x or 8.0, the only safe options are to upgrade it, isolate it, or take it down.

There's also a third, newer bug. PHP shared a mitigation for CVE-2026-115560, a separate remote code execution flaw that has no patch yet and only affects systems with what the PHP team called an unusual combination of configuration and application code. As of October 26, it wasn't in CISA's Known Exploited Vulnerabilities catalogue.^5,11

What to do today

1. Find every PHP runtime you own. Run php -v on servers you manage. Check containers, old staging boxes and that marketing microsite nobody remembers launching.
2. If you're on shared hosting, check your control panel. On cPanel hosts, the MultiPHP Manager shows which PHP version each site uses. Confirm your host has rolled out patched builds, and if you can't tell, open a ticket and ask in writing. As Eye Security's Vaisha Bernard told ITdaily, this isn't something you can fix by updating WordPress or plugins, because the flaw is in PHP itself.¹⁴
3. Use the stopgap only as a stopgap. Before patches were available, PHP's guidance was to set session.upload_progress.enabled=0 to block one attack path. It doesn't replace the update.¹¹
4. Assume compromise on anything that was exposed and unpatched. Look for new admin users, unfamiliar files in upload directories, and odd outbound connections. Rotate database passwords and API keys stored in config files, because code execution through PHP usually means the attacker can read them.

If your company has moved past chatbot experiments, you probably have something sitting between your apps and the AI model providers. It handles API keys, picks which model answers which request, logs usage and keeps costs in check. That layer is now one of the most valuable targets in your environment, and October made that obvious.

What happened on October 21

LiteLLM is one of the most widely used open-source AI gateways. It's a Python library and proxy that lets developers call dozens of model providers through one interface. Its popularity is the point: CSO Online put its downloads at roughly 95 million a month earlier this year.¹⁸

On October 21, attackers published a malicious version 1.107.0 to the Python Package Index (PyPI) and pushed matching tainted Docker images tagged v1.107.0, latest, main-latest and main-stable. According to LiteLLM's own incident report, as summarized by several security firms, the poisoned PyPI release was live from 11:39 to 13:23 UTC.^3,20

This time the attackers didn't upload a fake package from outside. Security write-ups describe stolen GitHub credentials being used to point LiteLLM's real release workflow at a lookalike repository. The official source tag stayed clean, but the packages built and shipped to users carried a credential stealer.^17,21

The payload drops files (cook.pth, cook.py and sitecustomize.py) into the Python environment. Python loads those automatically every time an interpreter starts, even if the program never imports LiteLLM.²² Then it goes hunting for secrets.

And this was the second time

In March, two malicious LiteLLM releases, versions 1.82.7 and 1.82.8, sat on PyPI for about 40 minutes after an attacker used a stolen publishing token.²³ That earlier compromise has been linked to a poisoned security scanner in LiteLLM's build process. PyPI's incident report estimated about 119,000 downloads during that window, according to a comparison of the two incidents published by Newly. Datadog said on October 21 that no link between the two compromises had been established.¹⁷

LiteLLM says earlier versions and its private Enterprise build weren't affected in October.¹⁷

It wasn't the only one

October's incident trackers read like a list of developer tooling under siege: hijacked GitHub release downloads for OVHcloud's command-line tool, a potential exposure of environment variables at the hosting platform Railway, a breach at the deployment platform Zeabur using leaked plaintext credentials, and stolen management keys used against WordPress sites through the UpdraftCentral backup service.²⁴ The common thread is that attackers are going after the systems that hold everyone else's keys.

Why AI gateways are tier-zero now

An AI gateway, by design, holds API keys for every model provider you use, often your cloud credentials too, and sees every prompt and response that passes through it. If it's compromised, an attacker can rack up model bills on your account, read sensitive data in prompts, and pivot into your cloud.

The trend is also heading toward more autonomy, not less. Google announced on October 8 that its new Gemini enterprise agent gets its own workplace identity, complete with an email address.²⁵ IBM launched agent identity and access controls on October 27.²⁶ And according to VentureBeat, Gartner expects agent costs to rise fivefold by 2028 even as per-token prices fall, because agents make so many calls.¹⁹ More calls, more keys, more spend flowing through one chokepoint.

For what it's worth, the market hasn't caught up. SoftwareReviews opened an AI Gateways category this year, and as of October 29, none of its ten listed products, LiteLLM included, has enough reviews to be scored.²⁷

What good looks like

1. Pin and verify. Lock dependency versions with hashes, not just version numbers. Never deploy containers from mutable tags like latest in production.
2. Mirror what you install. Pull packages through a private registry that delays brand-new releases by a day or two. Most poisoned releases are caught within hours.
3. Make keys short-lived and narrow. One key per provider, per environment, with spending caps. Rotate automatically.
4. Watch for startup hooks. Unexpected .pth or sitecustomize.py files in a Python environment are a red flag worth an alert.
5. Limit outbound traffic. Your gateway should only talk to the model providers you use. Anything else is suspicious.
6. If you ran 1.107.0 or the affected Docker tags on October 21, follow LiteLLM's remediation steps and rotate cloud credentials, SSH keys and AI provider keys.²⁰