The PHP flaw worth dropping your sprint for
Free weekly email
Published October 27. Get the next one.
One email every Tuesday: what changed in security and compliance that week, and what it means if you sell to enterprise buyers.
Free. Unsubscribe in one click, and replies reach Jacob directly. Read the latest issue or browse the archive.
Two things this week deserve time on your calendar before anything else: a pair of PHP vulnerabilities with working exploits, and a platform breach that may have handed over customer environment variables in plaintext. The rest of the week was settlements and statistics, which matter less urgently but will show up in the next security questionnaire you get from a US buyer. Here is what I made of it.
Unauthenticated RCE in PHP, exploited already
Source: Krebs on Security
Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed php2shell, allow an unauthenticated attacker to take full control of an affected server. Krebs reports that nearly 70 percent of websites need to update their core software, that working exploits exist, and that the bugs are already being exploited in the wild. CISA and the Cyber Centre both issued alerts and CISA has since added a SIGMA detection rule.
If you have any PHP serving web requests anywhere in your estate, including a marketing site, a legacy admin panel, or something a contractor stood up in 2019, that is your week. I would treat this as a patch-now item rather than a next-release item, because unauthenticated pre-application RCE means nothing in your code protects you. Worth checking your subprocessors too, since a compromised vendor host is still your incident to report.
Railway says attacker may have read decrypted environment variables
Source: The Hacker News
PaaS provider Railway disclosed anomalous activity involving the systems that store customer environment variables. The company found that an unauthorized third party may have accessed encrypted environment variables and in some cases obtained the decrypted contents. Railway says impact is limited to a subset of users and is urging credential rotation.
Environment variables are where most teams keep database passwords, Stripe keys and third-party API tokens, so this is a credential compromise until proven otherwise. Rotate on the assumption you were in the affected subset, and check whether you can actually tell which keys were where, because that inventory question is what slows most teams down during rotation. This is also the kind of incident a US enterprise buyer will ask about by name, and "we rotated everything within 48 hours" is a much better answer than silence.
Conduent proposes $80 million to end its breach class action
Source: Infosecurity
Conduent Business Services has proposed an $80 million settlement to resolve consolidated class action litigation over a 2024 cyber incident. Reporting puts the affected population at 62 million people whose healthcare data was involved.
Conduent is a business services provider, meaning the people suing were never its customers. That is the shape of risk you take on when you process data on behalf of regulated clients, and it is why enterprise contracts push breach liability down to you. I would read your current US customer agreements for the indemnity and liability cap language before you sign the next one, and price your insurance against what the contract actually says rather than what you remember agreeing to.
Most breach victims last year were breached through someone else
Source: Infosecurity
Kroll found that 69 percent of data breach victims over the past year were affected through a third-party breach. Attacks on technology companies were the single most common cause.
Vendor statistics usually bore me, but this one explains why your security reviews keep getting longer. When most breaches arrive through a supplier, and software vendors are the most common entry point, you are the supplier your prospect is worried about. The practical read is that questions about your subprocessor list, your vendor review process and your ability to cut off a compromised dependency are going to get more detailed, not less, so having real answers ready saves you weeks in the sales cycle.
CISA and the Cyber Centre on AI token spend as a resilience problem
Source: CISA
CISA, the Canadian Centre for Cyber Security and partners published joint guidance on managing AI token consumption. It warns that unmanaged token usage in third-party AI services can drive unpredictable costs, reduced service availability and degraded performance, and it names denial-of-tokens and denial-of-wallet attacks as a risk.
I like that two national agencies have put availability and billing abuse in the same document, because teams shipping AI features tend to treat the model provider as infrastructure that cannot fail. If an attacker can drive your token spend through a public endpoint, that is a denial of service with an invoice attached. Rate limits per tenant, a hard spending ceiling and an alert on anomalous usage are cheap controls, and auditors will start asking about AI vendor dependencies in availability testing before long.
Short version of the week: patch PHP, rotate anything that lived in a Railway environment variable, and assume your buyers now think of their vendors as the likeliest way in. I will be back next Monday.
Jacob
Free weekly email
Get the next issue on Tuesday
One email a week from Jacob Masse: the security and compliance stories that changed something that week, and what each one means if you sell software to enterprise buyers. Five stories, a take on each, five minutes to read.
Free. Unsubscribe in one click, and replies reach Jacob directly.