Security update: this week's internet incidents and how it is not affected ASComply

Sam Osipov · 22 October 2026

Railway, our former hosting provider, reported a security incident on 21 October. We replaced every credential we kept there when we moved our infrastructure to the other provider, researched and found no sign of access to customer data. Our infrastructure was already moved by the time of the incident.

This week several security issues hit the wider software industry, including one at Railway, the provider that hosted ASComply in the beginning of our journey. Here is what happened, what we did, and what changes for you.

Railway's incident

On 21 October, Railway reported that an attacker may have read the settings some of its customers keep on the platform, including passwords and keys. Railway has not yet said which accounts were involved. Since it is our

• We replaced every password and access key ASComply kept on Railway when we moved infrastructure from it, before the incident.
• We checked our code repository and our service providers for unusual activity and found none.
• Our database monitoring within the private network do not see any suspicious activity.

Other issues reported this week

We checked each of the other incidents reported this week against what ASComply runs on. None of them affects ASComply. For details, see the advisories:

• PHP2Shell, two critical PHP flaws (CERT-EU): https://cert.europa.eu/publications/security-advisories/2026-018/
• LiteLLM 1.107.0 supply-chain attack (Wiz): https://www.wiz.io/blog/litellm-compromised-steals-credentials
• eMudhra weak certificate authority keys (Help Net Security): https://www.helpnetsecurity.com/2026/10/21/emudhra-certificates-private-keys-compromised/
• Node.js October 2026 security releases (Node.js): https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
• Next.js critical remote code execution flaws (Cloud Security Alliance): https://labs.cloudsecurityalliance.org/research/csa-research-note-nextjs-use-cache-librsvg-rce-20261016-csa/
• TiDB Cloud security incident (PingCAP): https://www.pingcap.com/trust-hub/security/security-update-october-2026/
• Plex2Shell attacks on Plex Media Server (The Hacker News): https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html
• BeyondTrust Remote Support zero-day (BleepingComputer): https://www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august/
• Ivanti Connect Secure zero-day (Rapid7): https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935/

Questions? Write to us through the chat on this site or reply to any email from us.