# The Dodo Digest: Security Is Part of the Product > Railway's secrets exposure and the PHP2Shell vulnerabilities show how much of your security depends on systems you don't control. Plus native analytics widgets for iOS and Android. - **Author**: Rishabh Goel - **Published**: 2026-10-24 - **Category**: Newsletter - **URL**: https://dodopayments.com/blogs/en/newsletter-october24-2026 --- ### TL;DR - Railway disclosed a security incident that may have exposed customer secrets, while critical PHP vulnerabilities raised concerns across the web. - These incidents show how weaknesses in the systems you depend on can put your users' trust at risk. - For founders, security needs to be part of how you build, not something you figure out later. - On the product side, we've launched native analytics widgets for iOS and Android, bringing key business metrics straight to your phone's home screen. - We've also shipped updates across checkout, payment methods, moderation, subscriptions, and Dodo Sync. Hello everyone, I've been thinking about how much trust we place in the software we use, and how easily that trust can be tested when something goes wrong. Two recent incidents caught my attention. Railway, a development platform that raised $100 million in its Series B, disclosed that hackers may have accessed some customers' secrets. Around the same time, critical vulnerabilities dubbed PHP2Shell were discovered in PHP, which powers roughly 70% of websites. What stood out to me was how different these incidents were. One involved potentially exposed customer credentials. The other affected a technology used across a huge part of the internet. But both raise the same question: how much of your product's security depends on systems you don't control? ## The Signal The Railway incident is a good example of how quickly things can get complicated. Environment variables often contain API keys and credentials that applications use to access databases and cloud services. If those secrets are exposed, the risk can extend beyond the original platform. Railway advised all users to rotate their keys as a precaution, even though its initial assessment suggested the incident affected a subset of users. Then there's PHP2Shell. Researchers identified critical vulnerabilities that could allow remote code execution, and evidence suggested exploitation had begun before patches were publicly released. PingCAP, the company behind TiDB Cloud, also disclosed unauthorized access to certain internal systems, though it reported no evidence that data stored in TiDB databases was affected. Different incidents, but a similar lesson: the systems behind a product can create risks that aren't immediately visible to the people building it. A phone showing the UK National Cyber Security Centre news page "Critical security issue affecting PHP", urging organisations to act on CVE-2026-109618 and CVE-2026-109619 ## Why This Matters I think there's a lesson here for every founder. When you're building a startup, it's natural to focus on shipping faster, improving features, and getting your product in front of more customers. Security can feel like something to deal with once you've grown. But your customers aren't just trusting the product they see. They're trusting you with their data, their workflows, and sometimes critical parts of their business. That means understanding your dependencies, protecting credentials, limiting access, and knowing how you'll respond when something goes wrong. At Dodo Payments, payments infrastructure sits at the center of how businesses operate. Reliability and security have to be considered alongside the features we ship. That means continually reviewing our systems and improving how we protect sensitive information. You can't eliminate every risk. But you can make deliberate decisions to reduce avoidable ones. The important thing is to treat security as an ongoing responsibility, not a box you tick before launch. A post from @juampitech calling October "an absolute nightmare for software" and listing 15 incidents, including Railway, LiteLLM, Zeabur, OVHcloud CLI, PHP and Node.js, ending "the biggest security risk might not be the code we write, but the code we trust" ## What We Shipped We've released native analytics widgets for the Dodo Payments app on iOS and Android. Sometimes you just want to check your MRR or see how payments are doing, without opening the app and loading the dashboard. We built this for those quick checks. You can now keep the metrics you care about on your phone's home screen and take a look whenever you want. The widgets support: - Gross Volume - Payment Success Rate - MRR - Active Customers - Recovery - Net Revenue Retention Choose your metric and time range, then set the widget size to fit your home screen. On iPhone, you can pick small, medium, or large. On Android, you can resize it. Update the Dodo Payments app on the [App Store](https://apps.apple.com/in/app/dodo-payments/id6743651329) or [Google Play](https://play.google.com/store/apps/details?id=com.dodopayments.app) to try it. Six Dodo Payments analytics widgets: Gross Volume, MRR, Active Customers, Payment Success Rate, Recovery Overview, and Net Revenue Retention, each with a trend chart and change versus the previous period ## Alongside This We've also recently shipped a range of improvements across checkout, payment methods, subscription management, and developer tools. - **[Multi-Subscription Checkout](https://docs.dodopayments.com/changelog/v1.118.3#1-multi-subscription-checkout):** Customers can purchase multiple subscriptions in a single checkout and receive one invoice, while each subscription retains its own billing schedule. - **[Moderation API](https://docs.dodopayments.com/changelog/v1.118.3#2-moderation-api):** Screen text and images with allow, flag, or deny verdicts before they reach your product. - **[New Payment Methods](https://docs.dodopayments.com/changelog/v1.118.3#3-gcash-alipayhk-fps-and-touch-%E2%80%98n-go):** Added GCash in the Philippines, AlipayHK and FPS in Hong Kong, and Touch 'n Go in Malaysia. - **[Apple Pay in India](https://docs.dodopayments.com/changelog/v1.118.3#4-apple-pay-in-india):** Added Apple Pay support, including INR subscriptions through RBI mandates. - **[Ethoca Alerts](https://docs.dodopayments.com/changelog/v1.118.3#5-ethoca-alerts):** Merchants can opt in to automatically refund eligible payments when qualifying alerts arrive, helping prevent chargebacks. - **[Customer Email Logs and Test Mode Emails](https://docs.dodopayments.com/changelog/v1.118.3#6-customer-email-log):** Inspect delivery status, view and resend customer emails, and test email flows before going live. - **[Right-to-Left Checkout](https://docs.dodopayments.com/changelog/v1.118.3#8-right-to-left-checkout):** Added RTL layouts for Arabic and Hebrew. - **Subscription Cancellation Tracking:** API responses and webhooks now identify who cancelled a subscription. - **Payout and Dashboard Improvements:** Better payout settings and reserved balance visibility, a simpler verification flow, and redesigned dashboard navigation. - **[Dodo Sync 1.0](https://docs.dodopayments.com/changelog/v1.118.3#14-dodo-sync-1-0):** Our open-source sync package now includes faster batch writes, improved serverless reliability, and CLI credential masking. These updates make it easier to keep track of your business on the go while giving developers and merchants more control over their payments infrastructure. ## One Last Thought Security is easy to overlook when everything is working. But that's exactly when you should be paying attention. As founders, we have to think beyond what our products can do today and consider what our customers are trusting us to protect tomorrow. Build fast, but don't treat security as a trade-off you can always make later. The trust you earn from customers is difficult to build, and protecting it takes consistent effort. Also, join our loving [Discord community](https://discord.gg/dodo-payments-1305511580854779984)! Best, **Rishabh Goel** **Co-Founder, Dodo Payments** --- - [More Newsletter articles](https://dodopayments.com/blogs/category/newsletter) - [All articles](https://dodopayments.com/blogs)