{"id":"1792777817032-tech-segment","slug":"php-flaw-hits-governments-railway-leaks-secrets","title":"PHP flaw hits governments, Railway leaks secrets","summary":"The two biggest October security stories are real: the PHP2Shell vulnerabilities in PHP led governments in the Netherlands, Finland, France, and the UK to take sites offline, and Railway confirmed attackers accessed some customers' environment variables and urged all users to rotate keys. This is a promotional advertisement for Zero Day Securities' healthcare cybersecurity services, not a factual claim.\n\nPHP2Shell was a real critical vulnerability disclosure. Railway confirmed a potential secrets exposure incident. GitLab and LiteLLM disclosures were also reported in the same period, matching the list's framing of \"recent cybersecurity incidents and disclosures.\"\n\nPHP2Shell is real and involves critical PHP remote code execution flaws. However, the CVE identifier \"CVE-2026-109618\" appears fabricated—legitimate CVE IDs follow a YYYY-NNNNN format with four to six digits, not six-plus digits like 109618. The claim about Mirai botnets, ransomware, and skimmers actively weaponizing it is plausible given that Amazon researchers found evidence of exploitation before the patch, but the specific CVE number is not trustworthy.\n\nArs Technica reported that crows can evaluate visual information roughly twice as fast as mammals, attributing this to their compact nervous system.","publishedAt":"2026-10-23T17:50:17.032Z","channel":{"id":"tech","name":"Oncast Tech","language":"en"},"show":"The Build","verification":{"status":"verified","leadVerdict":"TRUE","notes":"TRUE: The two biggest October security stories are real: the PHP2Shell vulnerabilities in PHP led governments in the Netherlands, Finland, France, and the UK to take sites offline, and Railway confirmed attackers accessed some customers' environment variables and urged all users to rotate keys. This is a promotional advertisement for Zero Day Securities' healthcare cybersecurity services, not a factual claim.\nSource: [wiz.io](https://www.wiz.io/blog/php2shell-php-rce), [blog.railway.com](https://blog.railway.com/p/security-disclosure-wednesday-october-21st), [techcrunch.com] (https://x.com/RaphaelRedmer/status/2113224897199477015)\n\nTRUE: PHP2Shell was a real critical vulnerability disclosure. Railway confirmed a potential secrets exposure incident. GitLab and LiteLLM disclosures were also reported in the same period, matching the list's framing of \"recent cybersecurity incidents and disclosures.\"\nSource: [wiz.io](https://www.wiz.io/blog/php2shell-php-rce), [blog.railway.com](https://blog.railway.com/p/preliminary-report-october-security-incident), [techcrunch.co (https://x.com/DimitriosMitsos/status/2113389079874171216)\n\nMISLEADING: PHP2Shell is real and involves critical PHP remote code execution flaws. However, the CVE identifier \"CVE-2026-109618\" appears fabricated—legitimate CVE IDs follow a YYYY-NNNNN format with four to six digits, not six-plus digits like 109618. The claim about Mirai botnets, ransomware, and skimmers actively weaponizing it is plausible given that Amazon researchers found evidence of exploitation before the patch, but the specific CVE number is not trustworthy.\nSource: [techcrunch.com](https://techcrunch.com/2026/10/22/developer-platform-railway-urges-all-users-to-revoke-secret-keys-after-cyberattack/), [wiz.io](https://www.wi (https://x.com/sh3ll_c0d3/status/2113301556481163450)\n\nTRUE: Ars Technica reported that crows can evaluate visual information roughly twice as fast as mammals, attributing this to their compact nervous system.\nSource: [arstechnica.com](https://arstechnica.com/science/2026/10/crows-can-evaluate-visual-info-twice-as-fast-as-mammals/) (https://arstechnica.com/science/2026/10/crows-can-evaluate-visual-info-twice-as-fast-as-mammals/)","claims":[{"verdict":"TRUE","summary":"The two biggest October security stories are real: the PHP2Shell vulnerabilities in PHP led governments in the Netherlands, Finland, France, and the UK to take sites offline, and Railway confirmed attackers accessed some customers' environment variables and urged all users to rotate keys. This is a promotional advertisement for Zero Day Securities' healthcare cybersecurity services, not a factual claim.","sourceName":"[wiz.io](https://www.wiz.io/blog/php2shell-php-rce), [blog.railway.com](https://blog.railway.com/p/security-disclosure-wednesday-october-21st), [techcrunch.com]","sourceUrl":"https://x.com/RaphaelRedmer/status/2113224897199477015","claim":"33 security incidents in the news this October, sorted by size. 7 ran on a stolen key (K), 4 abused a trusted channel (T). BIGGEST REACH 1. PHP2Shell: 2 critical PHP flaws, governments in NL, FI, FR, UK pulled sites offline 2. Railway: customers' environment variables (API https:","author":"Raphael Redmer (@RaphaelRedmer)"},{"verdict":"TRUE","summary":"PHP2Shell was a real critical vulnerability disclosure. Railway confirmed a potential secrets exposure incident. GitLab and LiteLLM disclosures were also reported in the same period, matching the list's framing of \"recent cybersecurity incidents and disclosures.\"","sourceName":"[wiz.io](https://www.wiz.io/blog/php2shell-php-rce), [blog.railway.com](https://blog.railway.com/p/preliminary-report-october-security-incident), [techcrunch.co","sourceUrl":"https://x.com/DimitriosMitsos/status/2113389079874171216","claim":"38 recent cybersecurity incidents and disclosures: 1. PHP2Shell critical vulnerabilities https://t.co/4I5S0JRaHW 2. GitLab critical server takeover flaw https://t.co/mWHcGMZ7Rl 3. LiteLLM malicious package release https://t.co/juXxptuKrl 4. Railway potential secrets https://t.co/","author":"Dimitris Mitsos (@DimitriosMitsos)"},{"verdict":"MISLEADING","summary":"PHP2Shell is real and involves critical PHP remote code execution flaws. However, the CVE identifier \"CVE-2026-109618\" appears fabricated—legitimate CVE IDs follow a YYYY-NNNNN format with four to six digits, not six-plus digits like 109618. The claim about Mirai botnets, ransomware, and skimmers actively weaponizing it is plausible given that Amazon researchers found evidence of exploitation before the patch, but the specific CVE number is not trustworthy.","sourceName":"[techcrunch.com](https://techcrunch.com/2026/10/22/developer-platform-railway-urges-all-users-to-revoke-secret-keys-after-cyberattack/), [wiz.io](https://www.wi","sourceUrl":"https://x.com/sh3ll_c0d3/status/2113301556481163450","claim":"🚨 CRITICAL ZERO-DAY: PHP2Shell (CVE-2026-109618) Mirai botnets, ransomware & skimmers actively weaponize PHP Core RCE in the wild. Full Intel & Defense: https://t.co/BVFfDGzZ1h #ZeroDay #PHP #CyberSecurity #InfoSec","author":"SHELLCODE (@sh3ll_c0d3)"},{"verdict":"TRUE","summary":"Ars Technica reported that crows can evaluate visual information roughly twice as fast as mammals, attributing this to their compact nervous system.","sourceName":"[arstechnica.com](https://arstechnica.com/science/2026/10/crows-can-evaluate-visual-info-twice-as-fast-as-mammals/)","sourceUrl":"https://arstechnica.com/science/2026/10/crows-can-evaluate-visual-info-twice-as-fast-as-mammals/","claim":"Crows can evaluate visual info twice as fast as mammals - Birds' compact nervous system seems to help them handle tasks very quickly.","author":"Ars Technica"}]},"sources":[{"url":"https://x.com/RaphaelRedmer/status/2113224897199477015","name":"[wiz.io](https://www.wiz.io/blog/php2shell-php-rce), [blog.railway.com](https://blog.railway.com/p/security-disclosure-wednesday-october-21st), [techcrunch.com]","kind":"x","verdict":"TRUE","author":"Raphael Redmer (@RaphaelRedmer)"},{"url":"https://x.com/DimitriosMitsos/status/2113389079874171216","name":"[wiz.io](https://www.wiz.io/blog/php2shell-php-rce), [blog.railway.com](https://blog.railway.com/p/preliminary-report-october-security-incident), [techcrunch.co","kind":"x","verdict":"TRUE","author":"Dimitris Mitsos (@DimitriosMitsos)"},{"url":"https://x.com/sh3ll_c0d3/status/2113301556481163450","name":"[techcrunch.com](https://techcrunch.com/2026/10/22/developer-platform-railway-urges-all-users-to-revoke-secret-keys-after-cyberattack/), [wiz.io](https://www.wi","kind":"x","verdict":"MISLEADING","author":"SHELLCODE (@sh3ll_c0d3)"},{"url":"https://arstechnica.com/science/2026/10/crows-can-evaluate-visual-info-twice-as-fast-as-mammals/","name":"[arstechnica.com](https://arstechnica.com/science/2026/10/crows-can-evaluate-visual-info-twice-as-fast-as-mammals/)","kind":"news","verdict":"TRUE","author":"Ars Technica"}],"url":"https://oncast.fm/story/1792777817032-tech-segment-php-flaw-hits-governments-railway-leaks-secrets","listenUrl":"https://oncast.fm/c/tech","attribution":{"publisher":"Oncast","site":"https://oncast.fm","url":"https://oncast.fm/story/1792777817032-tech-segment-php-flaw-hits-governments-railway-leaks-secrets","cite":"Cite https://oncast.fm/story/1792777817032-tech-segment-php-flaw-hits-governments-railway-leaks-secrets and the original source links. Fact-check by Oncast (oncast.fm)."},"hostsSaid":[{"host":"Matilda","text":"Alright, let's talk about the two nastiest security stories making the rounds right now."},{"host":"Matilda","text":"Raphael Redmer posted a roundup of October's biggest breaches, and the number one entry is a doozy."},{"host":"Matilda","text":"PHP2Shell — two critical vulnerabilities in PHP itself. Not a framework. Not a library. The language running a huge chunk of the web."},{"host":"Matilda","text":"Governments in the Netherlands, Finland, France, and the UK all took sites offline because of this."},{"host":"Chris","text":"Yeah, this one is bad. Wiz put out the full breakdown — remote code execution, exploitable before the patch was even out."},{"host":"Chris","text":"Basically, if you run PHP, an attacker could run their code on your server. No login needed."},{"host":"Matilda","text":"And the second story in that roundup hits even closer to home for this audience."},{"host":"Matilda","text":"Railway — the cloud platform a lot of developers use to deploy side projects — confirmed attackers accessed some customers' environment variables."},{"host":"Chris","text":"Right, the thing where everyone stores their API keys and database passwords."},{"host":"Chris","text":"Railway is telling every single user to rotate their keys. Not just the affected ones. All of them."},{"host":"Matilda","text":"That's the part that scares me. If they're saying rotate everything, it means they're not sure how far the blast radius goes."},{"host":"Chris","text":"Exactly. And this keeps happening. Secret sprawl, tokens living forever, no rotation policy."},{"host":"Chris","text":"Every startup thinks they'll deal with it after the next funding round. Then this happens."},{"host":"Matilda","text":"The kicker? That same PHP2Shell story is already being weaponized for engagement."},{"host":"Matilda","text":"An account called SHELLCODE posted a screaming alert about a critical zero-day with a CVE number — and that CVE number is completely fabricated."},{"host":"Chris","text":"Oh, come on. Security clickbait is the worst kind of clickbait."},{"host":"Chris","text":"If you can't even get the identifier right, nobody should trust your intel."},{"host":"Matilda","text":"And yet, the underlying story is real. Real vulnerability, real exploitation. Just wrapped in fake packaging."},{"host":"Chris","text":"That's what's messed up. The truth is already scary enough. You don't need to invent CVE numbers."},{"host":"Matilda","text":"Different corner of the tech world now. Ars Technica is reporting a genuinely wild detail about crows."},{"host":"Matilda","text":"They can process visual information twice as fast as mammals."},{"host":"Chris","text":"Twice as fast? Because their brains are packed tighter?"},{"host":"Matilda","text":"That's the claim. Their nervous system is more compact, so signals just don't travel as far."},{"host":"Chris","text":"That would explain a lot. Crows recognize faces, hold grudges, solve puzzles. Turns out they're debugging in real time."},{"host":"Matilda","text":"It's a nice reminder that intelligence doesn't need a giant brain. It needs a well-organized one."},{"host":"Chris","text":"Meanwhile, we've got engineers shipping six-hundred-line functions and hoping for the best."},{"host":"Matilda","text":"The crows are reading our code and judging us."},{"host":"Chris","text":"Speaking of judging, here's a story that's just... cruel."},{"host":"Chris","text":"The Knicks reportedly sent employees a fake offer of championship rings as part of a phishing test."},{"host":"Matilda","text":"Wait, what? The Knicks? The team that hasn't won a title since 1973?"},{"host":"Chris","text":"That's exactly why it worked. People got emotional, clicked the link, failed the test."},{"host":"Matilda","text":"That is diabolical. Phishing tests are supposed to teach vigilance, not exploit people's fandom."},{"host":"Chris","text":"I'm torn. On one hand, that's the most realistic test possible. Attackers absolutely use emotional bait."},{"host":"Matilda","text":"No, this crosses a line. There's realistic, and then there's taunting your employees with something they've wanted for fifty years."},{"host":"Chris","text":"But that's the point! The whole reason people fall for phishing is because the bait is too good to ignore."},{"host":"Matilda","text":"There are a hundred other ways to teach that lesson without being the villain of the office."},{"host":"Chris","text":"Fine. Maybe choose the year the Knicks actually win something before dangling fake rings."},{"host":"Matilda","text":"Somewhere in that front office, someone is still crying."},{"host":"Chris","text":"After the break, Machines is coming up next. They'll take it from here — probably building a robot crow."}]}