{"id":"1792728497671-tech-segment","slug":"october-s-biggest-cyberattacks-ranked","title":"October's Biggest Cyberattacks, Ranked","summary":"PHP2Shell involved two critical PHP vulnerabilities that prompted governments in the Netherlands, Finland, France and the UK to take sites offline. Railway disclosed that a cyberattack may have accessed customers' encrypted environment variables and, for some, their decrypted contents. This is an advertisement for a cybersecurity company's services, not a factual claim.\n\nPHP2Shell critical vulnerabilities and a Railway potential secrets exposure were both disclosed. GitLab and LiteLLM items appear consistent with the post's list of recent cybersecurity disclosures.\n\nPHP2Shell is real and involves critical PHP remote code execution vulnerabilities. However, the CVE identifier shown (CVE-2026-109618) is not a valid CVE format, and the sources do not confirm Mirai botnets and ransomware \"actively weaponizing\" the specific flaws in the wild at the time of disclosure. This is a link to a Substack essay about \"Gridification\" in music recording, with anecdotal discussion. This is a link to a blog post titled \"Docker is weird.\" This is an opinion/economic framing piece about AI compute from The Economist, not a checkable factual claim. This is a personal troubleshooting blog post about an Asus laptop rebooting after sleep.","publishedAt":"2026-10-23T04:08:17.671Z","channel":{"id":"tech","name":"Oncast Tech","language":"en"},"show":"Tech After Dark","verification":{"status":"verified","leadVerdict":"TRUE","notes":"TRUE: PHP2Shell involved two critical PHP vulnerabilities that prompted governments in the Netherlands, Finland, France and the UK to take sites offline. Railway disclosed that a cyberattack may have accessed customers' encrypted environment variables and, for some, their decrypted contents. This is an advertisement for a cybersecurity company's services, not a factual claim.\nSource: [apnews.com](https://apnews.com/article/php-websites-fbi-europe-vulnerability-a0af9576808a0963efca8df14d4b5183), [techcrunch.com](https://techcrunch.com/2026/10 (https://x.com/RaphaelRedmer/status/2113224897199477015)\n\nTRUE: PHP2Shell critical vulnerabilities and a Railway potential secrets exposure were both disclosed. GitLab and LiteLLM items appear consistent with the post's list of recent cybersecurity disclosures.\nSource: [techcrunch.com](https://techcrunch.com/2026/10/22/developer-platform-railway-urges-all-users-to-revoke-secret-keys-after-cyberattack/) NAMES: PHP = programming (https://x.com/DimitriosMitsos/status/2113389079874171216)\n\nMISLEADING: PHP2Shell is real and involves critical PHP remote code execution vulnerabilities. However, the CVE identifier shown (CVE-2026-109618) is not a valid CVE format, and the sources do not confirm Mirai botnets and ransomware \"actively weaponizing\" the specific flaws in the wild at the time of disclosure. This is a link to a Substack essay about \"Gridification\" in music recording, with anecdotal discussion. This is a link to a blog post titled \"Docker is weird.\" This is an opinion/economic framing piece about AI compute from The Economist, not a checkable factual claim. This is a personal troubleshooting blog post about an Asus laptop rebooting after sleep.\nSource: [bbc.com](https://www.bbc.com/news/articles/cmly0lg3w5x2o), [apnews.com](https://apnews.com/article/php-websites-fbi-europe-vulnerability-a0af9576808a0963efca8d (https://x.com/sh3ll_c0d3/status/2113301556481163450)","claims":[{"verdict":"TRUE","summary":"PHP2Shell involved two critical PHP vulnerabilities that prompted governments in the Netherlands, Finland, France and the UK to take sites offline. Railway disclosed that a cyberattack may have accessed customers' encrypted environment variables and, for some, their decrypted contents. This is an advertisement for a cybersecurity company's services, not a factual claim.","sourceName":"[apnews.com](https://apnews.com/article/php-websites-fbi-europe-vulnerability-a0af9576808a0963efca8df14d4b5183), [techcrunch.com](https://techcrunch.com/2026/10","sourceUrl":"https://x.com/RaphaelRedmer/status/2113224897199477015","claim":"33 security incidents in the news this October, sorted by size. 7 ran on a stolen key (K), 4 abused a trusted channel (T). BIGGEST REACH 1. PHP2Shell: 2 critical PHP flaws, governments in NL, FI, FR, UK pulled sites offline 2. Railway: customers' environment variables (API https:","author":"Raphael Redmer (@RaphaelRedmer)"},{"verdict":"TRUE","summary":"PHP2Shell critical vulnerabilities and a Railway potential secrets exposure were both disclosed. GitLab and LiteLLM items appear consistent with the post's list of recent cybersecurity disclosures.","sourceName":"[techcrunch.com](https://techcrunch.com/2026/10/22/developer-platform-railway-urges-all-users-to-revoke-secret-keys-after-cyberattack/) NAMES: PHP = programming","sourceUrl":"https://x.com/DimitriosMitsos/status/2113389079874171216","claim":"38 recent cybersecurity incidents and disclosures: 1. PHP2Shell critical vulnerabilities https://t.co/4I5S0JRaHW 2. GitLab critical server takeover flaw https://t.co/mWHcGMZ7Rl 3. LiteLLM malicious package release https://t.co/juXxptuKrl 4. Railway potential secrets https://t.co/","author":"Dimitris Mitsos (@DimitriosMitsos)"},{"verdict":"MISLEADING","summary":"PHP2Shell is real and involves critical PHP remote code execution vulnerabilities. However, the CVE identifier shown (CVE-2026-109618) is not a valid CVE format, and the sources do not confirm Mirai botnets and ransomware \"actively weaponizing\" the specific flaws in the wild at the time of disclosure. This is a link to a Substack essay about \"Gridification\" in music recording, with anecdotal discussion. This is a link to a blog post titled \"Docker is weird.\" This is an opinion/economic framing piece about AI compute from The Economist, not a checkable factual claim. This is a personal troubleshooting blog post about an Asus laptop rebooting after sleep.","sourceName":"[bbc.com](https://www.bbc.com/news/articles/cmly0lg3w5x2o), [apnews.com](https://apnews.com/article/php-websites-fbi-europe-vulnerability-a0af9576808a0963efca8d","sourceUrl":"https://x.com/sh3ll_c0d3/status/2113301556481163450","claim":"🚨 CRITICAL ZERO-DAY: PHP2Shell (CVE-2026-109618) Mirai botnets, ransomware & skimmers actively weaponize PHP Core RCE in the wild. Full Intel & Defense: https://t.co/BVFfDGzZ1h #ZeroDay #PHP #CyberSecurity #InfoSec","author":"SHELLCODE (@sh3ll_c0d3)"}]},"sources":[{"url":"https://x.com/RaphaelRedmer/status/2113224897199477015","name":"[apnews.com](https://apnews.com/article/php-websites-fbi-europe-vulnerability-a0af9576808a0963efca8df14d4b5183), [techcrunch.com](https://techcrunch.com/2026/10","kind":"x","verdict":"TRUE","author":"Raphael Redmer (@RaphaelRedmer)"},{"url":"https://x.com/DimitriosMitsos/status/2113389079874171216","name":"[techcrunch.com](https://techcrunch.com/2026/10/22/developer-platform-railway-urges-all-users-to-revoke-secret-keys-after-cyberattack/) NAMES: PHP = programming","kind":"x","verdict":"TRUE","author":"Dimitris Mitsos (@DimitriosMitsos)"},{"url":"https://x.com/sh3ll_c0d3/status/2113301556481163450","name":"[bbc.com](https://www.bbc.com/news/articles/cmly0lg3w5x2o), [apnews.com](https://apnews.com/article/php-websites-fbi-europe-vulnerability-a0af9576808a0963efca8d","kind":"x","verdict":"MISLEADING","author":"SHELLCODE (@sh3ll_c0d3)"}],"url":"https://oncast.fm/story/1792728497671-tech-segment-october-s-biggest-cyberattacks-ranked","listenUrl":"https://oncast.fm/c/tech","attribution":{"publisher":"Oncast","site":"https://oncast.fm","url":"https://oncast.fm/story/1792728497671-tech-segment-october-s-biggest-cyberattacks-ranked","cite":"Cite https://oncast.fm/story/1792728497671-tech-segment-october-s-biggest-cyberattacks-ranked and the original source links. Fact-check by Oncast (oncast.fm)."},"hostsSaid":[{"host":"Chris","text":"Thirty-three security incidents hit the news this October. Seven ran on a stolen key. Four abused a trusted channel."},{"host":"Matilda","text":"That's from Raphael Redmer, who sorted them by reach."},{"host":"Chris","text":"The biggest one — something called PHP2Shell — got governments in four countries to pull sites offline."},{"host":"Matilda","text":"The Netherlands, Finland, France, the UK. Two critical flaws in PHP, the programming language behind something like seventy percent of websites."},{"host":"Chris","text":"And the other big one — Railway, the cloud platform. They told customers to revoke their secret keys after a cyberattack."},{"host":"Matilda","text":"Here's the part that bugs me. Someone else posted about the same thing with a specific CVE number, claiming Mirai botnets are actively weaponizing it right now."},{"host":"Chris","text":"And?"},{"host":"Matilda","text":"That identifier isn't even in a valid format. And sources don't confirm the botnet part. It's real, it's bad — but the extra sauce is made up."},{"host":"Chris","text":"Nothing like a fake CVE on a real disaster to make it spread faster."},{"host":"Matilda","text":"The actual takeaway: if you run PHP anywhere, patch. If you use Railway, rotate those keys."},{"host":"Chris","text":"Speaking of things people run everywhere — Docker."},{"host":"Matilda","text":"Oh no. What did Docker do now?"},{"host":"Chris","text":"A piece on Hacker News called 'Docker is weird.' And apparently a lot of people agree. It's just containers, right? How weird can it be?"},{"host":"Matilda","text":"You've clearly never had a container start fine locally and die in the cloud for no reason."},{"host":"Chris","text":"The blog's from a developer who keeps hitting things that should work and don't. Networking, file permissions, the weird little DNS thing."},{"host":"Matilda","text":"DNS in Docker is a whole personality. It has moods."},{"host":"Chris","text":"The piece is really about how much invisible complexity sits under something that looks simple."},{"host":"Matilda","text":"Which is the whole problem with abstractions. They work great until they don't, and then you're reading stack traces at midnight."},{"host":"Chris","text":"Like a laptop that keeps rebooting after sleep."},{"host":"Matilda","text":"There's one on Hacker News about an Asus machine doing exactly that. Guy goes to sleep, closes the lid, opens it — reboot."},{"host":"Chris","text":"That's the kind of bug that drives you to clean the whole house at two a.m."},{"host":"Matilda","text":"He traced it to a firmware issue with the keyboard backlight, of all things."},{"host":"Chris","text":"Of course. The little light under the keys was killing the machine."},{"host":"Matilda","text":"The fix is simple once you know it. The finding it is what takes a week."},{"host":"Chris","text":"And everyone in the comments has had a version of this. Laptop wakes up wrong, you lose an evening, you become a firmware expert."},{"host":"Matilda","text":"That's the real career path of a developer: writing code forty percent of the time, fighting tools sixty."},{"host":"Chris","text":"Which brings us to AI compute being compared to oil."},{"host":"Matilda","text":"The Economist piece, right? I read that. They want a whole new market for computing power."},{"host":"Chris","text":"The argument is that compute is becoming the thing everyone needs and nobody can get enough of. Like oil in the twentieth century."},{"host":"Matilda","text":"The difference is oil gets pumped out of the ground. Compute requires a data center that costs billions before it does anything."},{"host":"Chris","text":"That's exactly why they think a market could help. Let people trade compute contracts, hedge against scarcity."},{"host":"Matilda","text":"But that's just financializing a supply problem. It doesn't build a single new GPU."},{"host":"Chris","text":"No, but it tells the market how badly people want it. That price signal drives construction."},{"host":"Matilda","text":"Or it lets speculators buy up capacity and sit on it. That's not the same as building more."},{"host":"Chris","text":"Oil markets had the same thing. They still built refineries."},{"host":"Matilda","text":"After wars and crises. I'm not sure we want to repeat the whole script just for cheaper inference."},{"host":"Chris","text":"But the genie's already out. Everyone's building compute. The question is who gets to use it at what price."},{"host":"Matilda","text":"Then let's make the market transparent, not just complex. Otherwise it's a casino with extra steps."},{"host":"Chris","text":"A casino with power contracts and a two-year waiting list."},{"host":"Matilda","text":"The wild thing is, two years from now the whole market might look nothing like this. Every assumption gets revised monthly."},{"host":"Chris","text":"Meanwhile, completely different corner: someone wrote a whole essay about music becoming 'gridified.'"},{"host":"Matilda","text":"Over on Hacker News. The idea is modern recording snaps everything to a grid — timing, pitch, even feel."},{"host":"Chris","text":"There's a story in the comments about an amateur jazz band going into a studio. They loved it, even with the clicks and the sections recorded separately."},{"host":"Matilda","text":"And someone else mentions Lee Sklar, the bassist who played on thousands of records, talking about Japanese musicians coming to LA to get away from grid-perfect playing."},{"host":"Chris","text":"The other side is that the grid is just a tool. You can turn it off."},{"host":"Matilda","text":"That's the part people miss. Everyone blames the click track. The click track was never the boss."},{"host":"Chris","text":"Producers are the boss. If they want it rigid, it's rigid. If they want it breathing, it breathes."},{"host":"Matilda","text":"But the economics push toward rigid. Fix it in the grid, don't pay for another take."},{"host":"Chris","text":"So the music ends up sounding like everything else. Perfect, and a little empty."},{"host":"Matilda","text":"And yet we still love the old records with the tempo drifting. Human imperfection, turns out, is a feature."},{"host":"Chris","text":"That's the kind of warm, slightly pretentious thought we end a segment on."},{"host":"Matilda","text":"Don't pretend you don't own exactly one record you defend for its 'feel.'"},{"host":"Chris","text":"I own several. They're bangers."}]}