Halloween has come and gone, but businesses that depend on connected systems are still feeling spooked. In the space of a few weeks, a popular cloud hosting platform was breached, a critical flaw surfaced in the language that powers much of the web, a widely used AI library was turned into a credential stealer, and one of the world's largest grocery groups took its websites and apps offline.
None of these were isolated scares.
Together, they show what IT leaders now face every month: attacks that move through the platforms, packages and integrations businesses trust most.
A month of real scares
A hosting platform breach.
On 20 October, cloud platform Railway detected a sustained, targeted campaign against its infrastructure. By Railway's own account, the attackers were trying to obtain AI provider API keys. A subset of customers' encrypted secrets was exposed, and Railway urged every customer who signed up before 21 October to rotate the credentials stored on its platform. Builds and deployments were paused while the company contained the attack.
A critical flaw in PHP.
On 21 October, the PHP project released fixes for two critical remote code execution vulnerabilities, known as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619). They let an unauthenticated attacker run code on servers running PHP. The US Cybersecurity and Infrastructure Security Agency (CISA) urged immediate patching and, on 26 October, added both flaws to its Known Exploited Vulnerabilities catalogue. Some organisations took PHP sites offline until they could patch.
A poisoned AI library.
Also on 21 October, a malicious release of LiteLLM, a popular open source library for connecting applications to AI models, was published to the Python Package Index and official container images. It was live for about two hours. In that time, it installed a credential stealer targeting cloud, developer, browser and AI-provider secrets.
A retailer goes dark.
Earlier in the month, Ahold Delhaize, owner of Food Lion, Stop & Shop and Albert Heijn, detected malicious activity in its IT infrastructure. As a precaution, it took brand websites and apps offline across Europe and the United States, and US online ordering only returned about a week later. Stores stayed open, and the company said it had no evidence that sensitive data was taken.
The common thread: Trust and secrets
Look closely and the same pattern presents itself. Attackers rarely break down the front door; they go after the systems in between: the platform that hosts your applications, the package your developers install, the API keys that let one system talk to another.
For most mid-sized and enterprise organisations, that in-between layer is enormous. ERPs, CRMs, e-commerce stores, payment gateways, service desks and, increasingly, AI tools, are all connected. Every connection carries sensitive credentials. When those connections are built one script at a time, the credentials end up in many places: environment variables, configuration files, a developer's laptop. It’s easy to lose track of where these keys exist over time, and each one can be stolen.
Why audited controls matter more than ever
When a supplier is breached, the question every customer asks is simple: what controls did they have in place, and who checked them?
That's why independent assurance such as SOC 2 Type II has moved from a procurement checkbox to a real competitive differentiator. A SOC 2 Type II report means an independent auditor has tested a provider's security controls over a period of time, not just on the day of an audit.
Flowgear's controls are independently audited to the SOC 2 Type II standard. Every plan runs on dedicated infrastructure for strong tenant isolation, and data is encrypted at rest and in transit. Role-scoped permissions control who can build, change and run integrations, and workflow runs and production changes are recorded in an audit trail.
For businesses connecting critical systems, that changes the risk equation. Instead of scattering credentials across scripts and servers, integrations run through one governed platform that is independently checked.
Practical steps for the new reality
- Inventory your connections. Know which systems talk to which, and what credentials each connection uses.
- Rotate and centralise secrets. If you used any platform or package affected this October, rotate the keys now, and keep them in one controlled place from here on.
- Patch fast and know your stack. Keep a regularly updated catalogue of the software and apps your business runs, and what each depends on: the language it is built in, its libraries and its database. A Flowgear assessment is a practical starting point.
- Ask suppliers for evidence. Request current SOC 2 Type II reports from the platforms that handle your data and integrations.
- Put AI on the same rails. AI tools and agents that connect to business systems should go through the same governed, audited layer as everything else.
The takeaway
Threats will keep arriving through the platforms and connections businesses rely on. The organisations that sleep well are the ones that know where their data flows, who can touch it, and that an independent auditor has checked the controls.
Flowgear is an enterprise integration platform, independently audited to SOC 2 Type II, that helps businesses connect their systems securely and govern every integration in one place.
Share
