The two biggest October security stories are real: the PHP2Shell vulnerabilities in PHP led governments in the Netherlands, Finland, France, and the UK to take sites offline, and Railway confirmed attackers accessed some customers' environment variables and urged all users to rotate keys. This is a promotional advertisement for Zero Day Securities' healthcare cybersecurity services, not a factual claim.
PHP2Shell was a real critical vulnerability disclosure. Railway confirmed a potential secrets exposure incident. GitLab and LiteLLM disclosures were also reported in the same period, matching the list's framing of "recent cybersecurity incidents and disclosures."
PHP2Shell is real and involves critical PHP remote code execution flaws. However, the CVE identifier "CVE-2026-109618" appears fabricated—legitimate CVE IDs follow a YYYY-NNNNN format with four to six digits, not six-plus digits like 109618. The claim about Mirai botnets, ransomware, and skimmers actively weaponizing it is plausible given that Amazon researchers found evidence of exploitation before the patch, but the specific CVE number is not trustworthy.
Ars Technica reported that crows can evaluate visual information roughly twice as fast as mammals, attributing this to their compact nervous system.
MAlright, let's talk about the two nastiest security stories making the rounds right now.
MRaphael Redmer posted a roundup of October's biggest breaches, and the number one entry is a doozy.
MPHP2Shell — two critical vulnerabilities in PHP itself. Not a framework. Not a library. The language running a huge chunk of the web.
MGovernments in the Netherlands, Finland, France, and the UK all took sites offline because of this.
CYeah, this one is bad. Wiz put out the full breakdown — remote code execution, exploitable before the patch was even out.
CBasically, if you run PHP, an attacker could run their code on your server. No login needed.
MAnd the second story in that roundup hits even closer to home for this audience.
MRailway — the cloud platform a lot of developers use to deploy side projects — confirmed attackers accessed some customers' environment variables.
CRight, the thing where everyone stores their API keys and database passwords.
CRailway is telling every single user to rotate their keys. Not just the affected ones. All of them.
MThat's the part that scares me. If they're saying rotate everything, it means they're not sure how far the blast radius goes.
CExactly. And this keeps happening. Secret sprawl, tokens living forever, no rotation policy.
CEvery startup thinks they'll deal with it after the next funding round. Then this happens.
MThe kicker? That same PHP2Shell story is already being weaponized for engagement.
MAn account called SHELLCODE posted a screaming alert about a critical zero-day with a CVE number — and that CVE number is completely fabricated.
COh, come on. Security clickbait is the worst kind of clickbait.
CIf you can't even get the identifier right, nobody should trust your intel.
MAnd yet, the underlying story is real. Real vulnerability, real exploitation. Just wrapped in fake packaging.
CThat's what's messed up. The truth is already scary enough. You don't need to invent CVE numbers.
MDifferent corner of the tech world now. Ars Technica is reporting a genuinely wild detail about crows.
MThey can process visual information twice as fast as mammals.
CTwice as fast? Because their brains are packed tighter?
MThat's the claim. Their nervous system is more compact, so signals just don't travel as far.
CThat would explain a lot. Crows recognize faces, hold grudges, solve puzzles. Turns out they're debugging in real time.
MIt's a nice reminder that intelligence doesn't need a giant brain. It needs a well-organized one.
CMeanwhile, we've got engineers shipping six-hundred-line functions and hoping for the best.
MThe crows are reading our code and judging us.
CSpeaking of judging, here's a story that's just... cruel.
CThe Knicks reportedly sent employees a fake offer of championship rings as part of a phishing test.
MWait, what? The Knicks? The team that hasn't won a title since 1973?
CThat's exactly why it worked. People got emotional, clicked the link, failed the test.
MThat is diabolical. Phishing tests are supposed to teach vigilance, not exploit people's fandom.
CI'm torn. On one hand, that's the most realistic test possible. Attackers absolutely use emotional bait.
MNo, this crosses a line. There's realistic, and then there's taunting your employees with something they've wanted for fifty years.
CBut that's the point! The whole reason people fall for phishing is because the bait is too good to ignore.
MThere are a hundred other ways to teach that lesson without being the villain of the office.
CFine. Maybe choose the year the Knicks actually win something before dangling fake rings.
MSomewhere in that front office, someone is still crying.
CAfter the break, Machines is coming up next. They'll take it from here — probably building a robot crow.