There’s the PHP signal: Two pre-auth RCEs, swathes of the internet possibly exposed. (Get the official advisory here and a high-fidelity, free scanner here* for detecting exposure from Shubham Shah and team.) Amazon says attacks may have started from October 17, check logs.
There’s the PHP noise: Did Chainguard break the embargo? (Yes, and the PHP Foundation is not happy.) Did OpenAI fail to properly credit Ryan Austin at Calif.io for finding the vulnerability first? Or was it Wiz?
Then there’s the evergreen context: Frontier models are going to keep making it easier to find vulnerabilities and exploit them. There are going to be a lot more celebrity bugs, sometimes amplified by Big Marketing.
Scale AI with confidence on the infrastructure built for it. Akamai Cloud delivers high-performance cloud computing with enterprise-grade security, core to edge. Learn more.
Meanwhile organisations will continue to get hacked because they are using “Password1” or, like OVHcloud, failing to notice a developer’s MacBook had an infostealer on it for a year and letting said developer link personal GitHub accounts to the corporate organisation without GitHub's "immutable releases" feature enabled; enabling a supply chain attack.
It's Plus ça change, plus c'est la même chose, but now on steroids.
We refer readers to Cloudflare CSO Grant Bourzikas’ sensible comments earlier this year after pointing Mythos at the company’s stack.
“The loudest reaction [from] security leaders has been about speed - scan faster, patch faster, compress the response cycle. More than one team we have spoken with is now operating under a two-hour SLA from CVE release to patch in production. The instinct is understandable: when the attacker timeline shortens, the defender timeline has to shorten with it.
“Faster is not going to be enough, and we think a lot of teams are about to spend a lot of time, effort, and money learning that the hard way.”
Let's get together
Honest conversations tend to happen best among a small cohort of people in which nobody is trying to sell a solution. (Perhaps the Shirky Principle holds: “Institutions will try to preserve the problem to which they are the solution.”) We're big fans of convening our community to break bread for sanity checks, information-sharing and relationship-building.
That is one of the principles of our biannual The Stack Summit. We love enterprise technology’s big Jamborees like Web Summit or re:Invent, but it’s the intimate, Chatham House rule gatherings where meaningful knowledge is often shared, connections forged, and intel disseminated.
We ran our first in New York in April. There were just 50 people in the room. Together, they held over $25 billion in annual technology budget.
We’re back in London on November 4th. I’ll be hosting a fireside conversation with the Group COO of the UK’s biggest bank and the Group CTO of the UK’s biggest pharmaceutical company to kick things off.
Both Ron van Kemenade and Shobie Ramakrishnan are deeply insightful and very candid leaders. We’ll be getting real about their views on evolving architectures, operational models, and the maturity or otherwise of their teams’ agentic efforts as well as more broadly how they are harnessing AI, data, and process changes to drive organisational growth.
We also have sessions with one of Europe’s largest digital banks about how it built its award-winning customer service agent for 20 million customers on a mix of LLMs and SLMs without, well, breaking the bank.
We're getting technical about running AI behind an airgap and optimising smaller models for edge environments and more.
Generally speaking this is invitation-only: We have around 30,000 subscribers getting this mailshot and just 30 tickets left available, but if you’d like to be in the room, apply on Luma here and we’ll try to get you in the room. (Tickets are free if you are a paying subscriber to The Stack.)
Ping me an email if you have any questions: ed@thestack.technology
Thanks to our sponsors Dynatrace*,* Elastic*, and* GitLab*.*
We’re planning 2027’s NYC summit. Want to be involved? Just reach out.
The rest of The Stack
When your Muse needs GPUs: $140 billion in CapEx doesn't buy you enough compute, bewails Meta. Only 0.2% of its new user base is getting the new Muse agent, because, well, serving 3 billion people would be...
Small iron? Also reporting earnings was Big Blue, which isn't selling as mainframes as it would like, but has eased some concerns...
Missed our exclusive interview with HSBC's Group CTO?
He's hollowing out his tin and more...
We're also reading:
- NVIDIA and co. introduce "AW-0" a way to "jointly model code, future video, and robot actions as three coupled generative streams within a unified mixture-of-transformers architecture."
- Software deployment firm/"cloud" [Railway got hacked](https://blog.railway.com/p/security-disclosure-wednesday-october-21st?ref=thestack.technology)
- Via HBR, "[When restrictive cybersecurity policies backfire](https://hbr.org/2026/10/when-restrictive-cybersecurity-policies-backfire?ab=HP-hero-latest-2&ref=thestack.technology) "
- AWS is finally letting customers reserve compute capacity for Amazon Aurora and Amazon RDS DB instances across multiple AZs...
Thanks as ever for reading. We always love to hear from subscribers, so pop a line to ed@thestack.technology and tom@thestack.technology if you have something to share.
*re. PHP Datadog has the useful reminder to include containers and applications that bundle their own PHP interpreter in your inventory: “Don't rely solely on the command-line PHP installation: it can use a different version or configuration than the runtime that serves your web application.”