Canaries for the attacks that leave everything running

An attacker can get what they came for while your application carries on working. Pages load, background jobs finish, customers carry on with their day. Meanwhile, a credential copied from that machine is being used somewhere else, against a different service, on your account. That possibility is why I’ve become interested in canaries. There’s a gap between knowing your software is working and knowing somebody has been rummaging through it. The PHP disclosure on 21 October makes that gap uncomfortable. Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution. For Apache’s mod_php, the PHP team described a demonstrated exploit that can trigger before any application code runs. Before your application gets a chance to do anything. You can spend considerable effort reasoning about your routes, authentication and permissions, while a vulnerability underneath that code creates another way in. An advisory tells you that possibility…