PHP2Shell took European email platforms offline, Spamhaus published the rules it lists by, and a skip-ahead button for email courses
Four developments from October 21 to 23: the PHP flaw that switched European email platforms off, Spamhaus's own sender rules ahead of a November DNS rollout, a skip-ahead button for email courses, and how to route a complaint to the right abuse desk.
Coverage window: October 21, 2026 10:15 through October 23, 2026 10:15 (UTC+02:00). Two days, the Wednesday-to-Friday slot. Two of the four developments here need an inspection before the next send, and two cost an hour each in work already running.
European email platforms went dark over a PHP bug
What changed
The PHP project published fixes on October 21 for two remote code execution bugs in the PHP engine, tracked as CVE-2026-109618 and CVE-2026-109619. 1
The patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Every PHP release back to 5.4, published in 2012, carries the flaw. 12
Sansec, a security firm that tracks attacks on online stores, rates both bugs 9.2 on the CVSS v4.0 scale. Scores of 9.0 and above are labelled critical. 2
Both bugs are use-after-free flaws. A fatal error part-way through a request can leave freed memory in place, and the next request on the same worker treats that memory as live data. 2
One of the two also returns memory to the client inside a PHPSESSID cookie. Sansec says that memory can hold passwords, session tokens, API keys and TLS private keys. 2
The details leaked on October 20, a day before the patch. 3 Cloudflare logged attacks at 07:43 UTC on October 21, and PHP published the fixes around 14:00 UTC. 2
Email platforms across Europe spent that day deciding whether to stay up. Laposta, a Dutch newsletter platform, switched its systems off at 13:20 CEST and restored them at 17:58 CEST. 4
Campaign sending, the API, automations and statistics went down. Laposta warned that sign-up, unsubscribe and preference forms might fail, and so might the links and images in campaigns already delivered. 4
Deployteq, a Dutch marketing automation platform, took all its systems offline. Its click-tracking redirects ran on customer subdomains, so links in mail already sent stopped working with them. 3
Flowmailer and MailBlue shut parts of their own tooling as a precaution. The email alias service addy.io was offline for three and a half hours. 3
Postmark told customers using its PHP library or WordPress plugin to update PHP, and said the fault sat in neither. 3
Why it matters
An email program had two ways into this story: the server it sends from, and the credentials stored on that server.
A sender running Mautic, Sendy, MailWizz, phpList or Roundcube on their own hardware is exposed through the server. Updating the application leaves the flaw in place, because the flaw lives in PHP. 3
A sender whose ESP hosts everything is exposed through credentials. An API key lifted out of leaked worker memory lets someone send from that account, and the resulting mail passes SPF, DKIM and DMARC because it is the account's own. 2
Sansec revised the risk down on October 22. A working attack needs prior knowledge of the target and specific conditions on it, and the public exploits do not work against a default PHP installation. 2
That revision reframes the outages. Platforms switched off before anyone could say how easily the bug could be exploited against a real server. 2
The patch still matters on its own terms. An unpatched server that throws a fatal error under load leaves freed memory behind for the next request to reuse.
Checks before acting
- Ask your host or ESP, in writing, which PHP version each sending server runs, and check the answer against 8.5.12, 8.4.27, 8.3.36 and 8.2.35. 1
- If you run PHP 8.1 or older, ask for a backported package. PHP published source fixes for 7.4, 8.0 and 8.1, and several distributions ship their own builds. 12
- Rotate ESP API keys and SMTP passwords held on any PHP site that was online and unpatched after October 20. 3
- Test the sign-up and unsubscribe forms, and click one link in an older campaign, on any platform that went down this week. 4
Spamhaus published the rules it lists by
What changed
Spamhaus published Sender Guidelines on October 21: six sections of requirements and recommendations, plus a separate page for ESPs and large senders. 56
The document gathers guidance that had been scattered across FAQs, blog posts and support tickets, which is how Spamhaus describes its own reasons for writing it. 5
Five items carry the label of minimum requirement:
- Confirmed opt-in for all bulk email, with no send to an address that has not clicked a confirmation link. 6
- Forward-confirmed reverse DNS on every sending IP, meaning a PTR record whose hostname resolves back to that IP. 6
- A HELO/EHLO hostname that resolves to the sending IP and stays the same across connections. 6
- IPv6 allocations of /64 or larger, with reverse DNS in place. 6
- SPF, DKIM and DMARC on every sending domain, with the DKIM domain aligned to the From address. 6
The dated commitment is narrower than the document. From November 2026, Spamhaus will enforce basic DNS rules over several months: a valid HELO, a PTR record and a matching A record for every sending IP. 5
Two causes account for most listings, according to Spamhaus. Senders mail people who never asked, and servers announce themselves with DNS entries that do not match. 5
The guidelines also set a bounce ceiling below 5%, and tell ESPs to watch complaint rates above 0.3% at each customer account. 67
The ESP page adds its own list. It asks for a dedicated subdomain per customer, used as both From and DKIM domain, with DNS records removed when that customer leaves. 7
It also asks for a monitored abuse address, separate IPs for transactional and marketing mail, feedback loops at the major mailbox providers, and RFC 8058 one-click unsubscribe. 7
Why it matters
Confirmed opt-in reaches furthest into how a list is built. Single opt-in is a common default, and the guidelines put a confirmation click at the same level as reverse DNS. 6
A brand whose sign-up form sends no confirmation email now has a decision to make: add the confirmation step, or carry the listing risk on a list built without it.
The November deadline covers DNS alone. The permission rules carry the same weight in the document with no date attached. A sender with clean DNS can pass the enforcement and still be listed for the list underneath. 56
The ESP page also gives buyers a checklist. A platform that cannot name its subdomain setup, its abuse address and its feedback loops now fails a published test. 7
Checks before acting
- Run each sending IP through the HELO/DNS checker on the sender guidelines page, and fix anything that fails. 6
- Check your sending domain and IPs at check.spamhaus.org before the November rollout, and again after any infrastructure change. 6
- Ask your ESP for the reverse DNS and HELO values on the IPs your mail leaves from, and confirm the three records agree. 6
- For each list, record when and how the address confirmed, and stop mailing any source you cannot document. 6
- If you are buying sending infrastructure, ask the platform how it meets the ESP page's requirements. 7
A skip-ahead button for email courses
What changed
Email Advice in Your Inbox Volume 80, published October 22, adds a button to the bottom of every lesson in a seven-day course. The button sends the next lesson straight away. 8
The wait the button removes is a default setting. Most course automations release lesson two a day after lesson one because that is the default interval in the builder. 8
Des Brown's team hit a plan limit first. Click-triggered automations sit on a higher beehiiv tier, so the trigger runs outside the platform, with each lesson built as its own automation and chained by a one-day wait. 8
The button opens a small page on Netlify, and Make drops the subscriber into the next lesson's trigger. Each lesson arrives once, so the daily chain does not send a duplicate. 8
The build cost nothing beyond the existing beehiiv plan. Netlify's free tier hosts the page, and Make's free tier covers a few hundred sign-ups and skips a month. 8
One week of data so far: almost two-thirds of readers used the button at least once, and three people left the course, all on the same lesson. 8
Why it matters
Brown presents the two-thirds figure as a first look at one week of one new course, and the number carries that limit. 8
The three exits point somewhere more useful. All three left on the same lesson, the team rewrote that lesson, and a lesson-level exit count is what surfaced it. 8
The mechanics travel to other platforms. On Kit, Buttondown, Mailchimp or Brevo, the button just moves a subscriber into the next lesson's trigger. 8
A course also does a different job from a PDF at the moment someone subscribes. Daily tasks build an opening habit in the first week, the stretch in which a new address either becomes a reader or a forgotten download. 8
Checks before acting
- Pick the sequence with the strongest first lesson, and add the button there before December. 8
- Confirm the platform suppresses a duplicate when the daily chain catches up with a reader who skipped. 8
- Count exits on each lesson separately, so the weakest email shows up by name. 8
- If your plan already includes click-triggered automations, build the button inside the platform and skip the outside page. 8
How to complain so the complaint lands
What changed
Spam Resource ran a guest post on October 21 by Skyler Holobach, who runs an email deliverability consultancy, on tracing a piece of spam to the platform that sent it. 9
Gmail's "Show original" opens the full header block. The Message-ID at the top usually carries the sending platform's domain, which points at the ESP. 9
That field alone proves little, because a sender can set it. Lower down, an X-Report-Abuse header names the address to write to, and Holobach's example resolves to abuse@hubspot.com. 9
A useful report forwards the message, pastes the headers and explains how the address was used. That saves the abuse team a round of questions. 9
Holobach draws three limits. Unsubscribe first from any brand you have dealt with, and keep abuse reports for mail you never asked for. A form reply is the most to expect, since a platform will not discuss a customer's account with you. 9
Why it matters
Every complaint a recipient files about your mail travels this path in the other direction. Spamhaus's new ESP guidelines require a monitored abuse address for exactly that traffic. 7
An unmonitored abuse@ address is now a published failure, and the person on the other end of the report holds the headers that name your campaign. 79
The same header block serves a sender whose domain is being forged. It names the platform and the IP carrying the forged mail, which is where a takedown request goes. 9
Checks before acting
- Send a test message to your own abuse@ address this week, and confirm it arrives unfiltered and reaches a person. 7
- Give support and social teams the X-Report-Abuse route for complaints about mail you never sent. 9
- Keep the full headers of your worst complaint this month; they name the platform, the IP and the campaign. 9
Next audit
Two dates and one number. The PHP fixes are available now, so the server question can close this week. Spamhaus's DNS enforcement begins in November and rolls out over several months. The skip-ahead test needs one course and one week. The number is two-thirds, measured on a single new course, and worth testing against your own sequence before the December send.
References
- 1
- 2
- 3
- 4
- 5
- 6Spamhaus Sender Guidelines
spamhaus.org
- 7ESP & Large Sender Guidelines
spamhaus.org
- 8Email Advice in Your Inbox Vol. 80: Let Readers Skip Ahead in Your Email Course
emailadviceinyourinbox.com
- 9Complaining with style 101
spamresource.com
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.