PHP, Railway, ConnectWise: the week the internet had a security crisis (and what to do now)

Some weeks in cybersecurity are quiet. This was not one of them. In just a few days in October 2026, three big security incidents hit different parts of the internet at once: the programming language behind millions of websites, a popular developer cloud platform, and an IT company trusted by thousands of businesses.

Here’s a simple summary of each one, who should care, and one checklist to keep you safe.

1. PHP: critical flaws that let hackers take over web servers

What happened: On October 21, the PHP team released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. They can let an attacker run code on a web server without logging in. Details leaked early, and researchers nicknamed it “php2shell”. Some websites briefly went offline as operators rushed to fix it.

Who should care: anyone running a website on PHP, which includes WordPress, Drupal and Joomla sites.

What to do: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On shared hosting, ask your host to confirm the fix is installed. Updating WordPress plugins alone won’t fix it.

👉 Full guide: PHP fixes two critical flaws that let hackers take over web servers

2. Railway: customer secrets may have been exposed

What happened: On October 21, cloud platform Railway said an attacker may have accessed customer environment variables, “including some decrypted values”. These often hold API keys and database passwords. Railway paused deployments and believes the attack is part of a wider campaign to steal keys for AI services.

Who should care: developers and startups that host apps on Railway.

What to do: rotate every secret stored on Railway (API keys, database passwords, registry credentials), starting at the original service, and check bills and logs for unusual use.

👉 Full guide: Railway hit by security breach: rotate your keys now

3. ConnectWise: China-linked hackers hit about 2,250 organizations

What happened: Hackers stole application credentials from ConnectWise Cloud Backup (formerly SkyKick) and used them to log in to customers’ Microsoft 365 accounts, reaching emails and files. Microsoft linked the attack to a China state-aligned group and said it hit around 2,250 organizations, using an AI tool that made nearly 3,000 sign-in attempts per minute.

Who should care: businesses using Microsoft 365, especially if an IT provider (MSP) manages them with ConnectWise tools.

What to do: disable the affected ConnectWise apps in Microsoft Entra, review sign-ins and admin roles from October 13 onward, and remove unknown app secrets.

👉 Full guide: ConnectWise hack explained: is your company affected?

What these attacks have in common

Attackers go after the tools everyone trusts

None of these attacks targeted one company at a time. They hit shared foundations: a programming language, a hosting platform and a backup supplier. One weakness in a trusted tool can expose thousands of victims at once. This is called a supply chain risk.

AI is speeding things up, on both sides

Reports say AI tools helped researchers find the PHP flaws. The ConnectWise attackers used an AI framework to move faster than defenders could react. And Railway believes its attackers wanted to steal keys for AI services. AI is now part of almost every major security story.

Secrets and keys are the new target

Both Railway and ConnectWise were about stolen credentials, not broken passwords. Multi-factor authentication didn’t help in the ConnectWise case, because the attackers logged in as an app, not a person.

The question is no longer “are my passwords strong?” but “what can my tools and suppliers access, and could someone steal that access?”

Your simple security checklist

1. Update your software now: PHP, WordPress, plugins, your phone and computer. Turn on automatic updates where you can.
2. Rotate your API keys and passwords if you use Railway, and do it regularly anyway.
3. Set spending limits and alerts on paid APIs (especially AI services), so a stolen key can’t run up a huge bill.
4. Review app permissions in Microsoft 365, Google Workspace and GitHub. Remove apps you don’t use, and give the rest only the access they need.
5. Ask your suppliers questions: which tools does your hosting company or IT provider use, and have they been affected?
6. Keep backups you control, and test that you can restore them.

Frequently asked questions

Are these three attacks connected?

There’s no public evidence that they were carried out by the same people. They happened in the same week and share common themes, such as targeting trusted platforms and the growing role of AI.

I run a WordPress site. Which one matters most to me?

The PHP flaws. Make sure your host has installed the October 21 PHP security release.

I’m a developer. What should I do first?

If you use Railway, rotate your secrets right away. Then make sure any PHP servers you run are updated.

My company uses Microsoft 365. Am I at risk?

Only if you (or your IT provider) use ConnectWise Cloud Backup, SkyKick, or related ConnectWise cloud tools. Ask your IT team or provider to check.

Sources

• PHP security advisory and releases, October 21, 2026 (php.net)
• Railway security incident: environment variables may be exposed (Cybersecurity News)
• Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise (TechCrunch)
• Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack (BleepingComputer)