PostieDay 53 · 22 October 2026
Chapter 2 · 18 days to the chapter deadline
- PHP is Everywhere and Everyone is Being Attacked
Have you heard the news? "Extra Extra Read All About It". PHP is vulnerable. Admittedly this is old news as it broke yesterday but between the Opencode and Railway Hacks even before this PHP vulnerability disclosure it was already shaping up to be a notable week for security.
Both Opencode and Railway were attacked and API keys exposed and used within minutes. Gone are the days of waiting even a few hours before exploiting things. Opencode customer API keys were literally used in a few minutes. It's got me really thinking about how (if I add the integrations for AI) how I would handle a customer's external API keys... using a vault obviously and an external service sure but is that enough...
Forget even about Railway completely going dark and waiting hours and hours to respond and release information but API keys being exposed and rotated at the same time disabling builds so those now rotated keys couldn't be pushed up... what the heck are you meant to do with that? As a business how do you even function? How do customers function. Email is one of the the most essential things for any business...
I make a point of architecting Postie fully with Cloudflare on Cloudflare's platform and that has tremendous benefits but clearly if you put all your eggs in one basket if the basket has holes you loose your eggs. Terrible analogy but hopefully you get the meaning... what is my backup plan? Can i have one at all? What happens if I go down?
The more I think about it the more I don't think downtime matters (especially if it's an external upstream service)... what matters is communication and honesty with customers straight away even if you don't have all of the facts just reasuring customers you're working hard to get back online. Don't do a Railway if you can help it. I mean of course downtime of any type matters whether it's in your control or not, people using your service the buck stops with you but yeah. Hard questions this week already.
Hard questions that I can't spend too much time stressing over because I have to help a client migrate their custom CMS from PHP7.4 to 8.5. It's not as easy as it sounds. These however are the days I live for. It's just got me really adamant that we should update all our stuff and accept that any external information we give other companies like API keys going to be hacked and exfiltrated. It's not a question of if but when. How you respond when that happens (because it will happen) is the main thing.