🔒 Security update from EXC + Stashed + a full prompt you can run on your own! The last 48 hours were rough for the web. PHP2Shell (CVE-2026-109618 / CVE-2026-109619) lets attackers run code on unpatched PHP servers with a single request, and it's being exploited in the wild. Railway also disclosed that customer environment variables, the place where most apps keep their API keys, may have been accessed. We didn't wait around. Across EXC and Stashed we've: Updated our Docker images and base layers ✅ Upgraded Node across our services ✅ Hardened our builds, dependencies and deploy pipeline. Your listings, launches and orders stay protected. -- Vibe coding? Your app could be exposed and you'd never know. Copy this prompt into your AI coding agent (Cursor, Claude Code, Codex, whichever you use) and let it audit your stack 👇 Run a full security audit of every service, repo and deployment I own, focused on two incidents from Oct 2026: PHP2Shell (CVE-2026-109618 and CVE-2026-109619, unauthenticated remote code execution in PHP) and the Railway breach (customer environment variables, API tokens, bucket credentials and GitHub tokens possibly exposed). Start READ-ONLY. Report first, and don't change, deploy, rotate or delete anything until I approve. 1. INVENTORY: List every app, service, worker, cron job, database and domain, and where each one runs (Railway, Vercel, Docker, VPS, etc.). 2. PHP2SHELL: Find any PHP anywhere: in my code, Dockerfiles and base images, and inside bundled tools such as WordPress, phpMyAdmin, Adminer or CMS plugins. For each, report the PHP version and how it runs (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed). Anything below 8.5.12, 8.4.27, 8.3.36 or 8.2.35 is vulnerable. PHP 8.1 or older is end of life. Flag anything internet-facing as urgent. 3. RAILWAY: List every Railway project and the env variables each one uses (names only, never print values). Mark every secret stored there as must-rotate: API keys, database URLs, JWT and session secrets, webhook secrets, registry credentials, cloud keys, wallet keys. Check for Railway API tokens, bucket credentials and GitHub tokens that were reset and need replacing, and for services that need reconnecting to GitHub and redeploying. Tell me which audit-log entries to review for variable reads, deploys or credential changes I didn't make. 4. SECRETS: Scan every repo and its full git history (gitleaks or trufflehog), plus .env files, Docker images, CI logs and frontend bundles, for keys, private keys, wallet seeds and service-account JSON files. Check that .gitignore and .dockerignore exclude secrets. 5. DOCKER: Check for outdated or :latest base images, containers running as root, secrets baked into image layers, exposed ports, privileged mode and a mounted docker.sock. Scan images for known vulnerabilities (Trivy, Docker Scout or Grype). 6. NODE AND DEPENDENCIES: Report the Node version in every service, Dockerfile and CI config (it should be a supported LTS). Run npm audit, pnpm audit or yarn audit. Look for typosquatted or recently hijacked packages, suspicious install scripts, unpinned versions and missing lockfiles. 7. CONFIG: Check for debug mode in production, open admin panels, CORS set to *, missing security headers, unauthenticated API routes, webhooks that don't verify signatures, public storage buckets, and databases reachable from the internet. 8. REPORT: Give me a prioritized table (Critical, High, Medium, Low) with the finding, the file or service, why it matters and the exact fix. Then give me a step-by-step plan for rotating secrets, in an order that won't take my app down. Never print full secret values; show only the first 4 characters.