In October 2026, researchers used AI to find a flaw that had stayed hidden for fourteen years inside software that runs most of the web. It was nicknamed PHP2Shell. Working attacks followed within days, and some government websites went offline while they patched.
The interesting part is not the bug. It is who found it. An AI did, in a fraction of the time a human would have taken — and the same capability that finds a flaw can now exploit it at a speed defenders are not used to.
WHY A LOGISTICS BUYER SHOULD CARE
Your logistics platform holds consignment records, negotiated rates and the live position of every vehicle on the road. If that runs on a stack nobody has re-tested in years, the question is no longer whether your vendor uses good technology. It is whether they can show you they take security seriously.
The right response is not noise or fear. It is a few sharp questions, and specific answers.
SIX QUESTIONS WORTH ASKING ANY VENDOR
Put these to every logistics software vendor you evaluate, including us. A vendor who takes security seriously will answer each with specifics, not reassurance.
1. How fast do you patch a critical vulnerability, and when did you last do it? A credible answer is a date, not a promise. At WebXpress we act on critical vulnerabilities through a defined process, with security checks built into our release pipeline and each one tracked to closure.
2. Do you advertise your software versions publicly? If a vendor leaks its server, language or framework version, an automated scanner skips straight to the matching exploit. We suppress those details on our public surfaces.
3. Is the product your own engineering, or assembled on off-the-shelf plugins? Every third-party plugin is a vulnerability you inherit. WebXpress runs on our own platform, built over twenty years — not a content system stitched together with plugins. Fewer inherited parts, a smaller surface to defend.
4. Do you run independent penetration testing, and how often? We do. Independent penetration testing is part of our security programme, carried out alongside our SOC 2 work. We test ourselves before anyone else can.
5. Where do your passwords and keys live, in code or in a managed vault? Secrets hard-coded in a repository are how one exposed file becomes a breach of everything. Ours are held in a managed vault with scoped access, not in our applications.
6. Are you pursuing a recognised standard, and can you show evidence? Our SOC 2 programme is in its final stages. A certificate is a claim; we would rather walk a serious buyer through the scope and the controls under NDA.
WHAT WE WILL NOT CLAIM
No serious engineer says a system can never be attacked, and we will not either. What we commit to is the discipline that keeps us ahead: testing ourselves before anyone else can, acting quickly on what we find, and keeping our attack surface small. That work is never finished, and we treat it that way.
If security is part of how you choose a logistics platform, put these six questions to every vendor on your list. We are happy to answer all six, including a review of our controls under NDA. Ask us.