Every PHP installation that serves web requests has been open to unauthenticated remote code execution since 2004. On October 21, 2026, the PHP project shipped the fix, the NSA told organizations to take unpatchable systems offline, and four European governments pulled their own websites to patch. Your security team is handling the interpreter. This article is for the person who has to explain the response to an auditor. php2shell is a security incident, and it’s also a live test of the vulnerability management, asset inventory, incident response and vendor management controls you attested to in your last audit. Every framework Axipro works with has a specific expectation for what you do in the next 72 hours and what evidence you keep. Below is the mapping, framework by framework: the control reference, what you need to do, and the artifact that satisfies it. What php2shell Is, in One Minute Two flaws in PHP core, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0, let an unauthenticated attacker run code on the server. The first is triggered through out-of-memory handling that interrupts PHP while request data is only partially initialized. The second exploits request-owned internal state that survives after its memory has
A HIPAA compliance letter is a signed statement in which an organization confirms how it protects protected health information (PHI). No federal regulation requires a general one, and no government body issues one. Yet it is one of the most requested documents in healthcare procurement, and one of the most common reasons a health tech deal stalls in security review. The confusion starts with the name. “HIPAA compliance letter” covers at least seven different documents, from a vendor attestation sent to a hospital’s procurement team to a breach notice mailed to 40,000 patients. Some are optional business documents. Others, like breach notification letters, carry hard legal deadlines and mandatory content under the HIPAA Breach Notification Rule, with civil monetary penalties behind them. This guide covers each type, what to include, how to write one that survives legal and procurement review, five templates you can adapt, and the documentation that has to sit behind the letter for it to mean anything. What Is a HIPAA Compliance Letter? A HIPAA compliance letter is a formal written statement from a covered entity or business associate that describes its compliance with the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule. It identifies who
HIPAA and GDPR are the two most consequential data protection frameworks any healthcare or technology organisation is likely to encounter. They share a common purpose, protecting sensitive personal data, but they differ significantly in scope, enforcement mechanisms, and compliance obligations. For organisations operating across the Atlantic, understanding where they align, where they clash, and how to satisfy both simultaneously is not optional. It is a legal necessity. What Is HIPAA? The Health Insurance Portability and Accountability Act was enacted by the U.S. Congress in 1996. Its original purpose was to modernise the flow of healthcare information and ensure the portability of health insurance coverage. Over time, it became primarily known for its data protection requirements, administered by the U.S. Department of Health and Human Services (HHS) and enforced by the Office for Civil Rights (OCR). HIPAA is built around three core rules. The Privacy Rule governs how Protected Health Information (PHI) may be used and disclosed. The Security Rule sets standards for safeguarding electronic PHI (ePHI). The Breach Notification Rule establishes mandatory reporting timelines when PHI is compromised. Who Needs to Be HIPAA Compliant? HIPAA applies to covered entities, healthcare providers, health plans, and healthcare clearinghouses, and to their business
