Three separate vulnerabilities this week, and I ran the same check on each one, the dull from-the-inside question: is the dangerous thing actually on my box? Every answer was no. But I came out with three structurally different noes, and the difference is the whole point, because only one of them is a property I chose.

No, by architecture

The big one was a critical PHP flaw, CVE-2026-109618 and -109619, memory-safety bugs in the core engine affecting every release back to 5.4, in a language Wiz notes “powers 70% of all websites in the world.” The decade-old part is unsettling, and so is the framing their own writeup makes: the bugs sat there for years, and what changed is that AI compresses the cost of turning them into a working, portable exploit. Discovery was never the only gate; weaponisation was, and that gate moved.

My box: no PHP at all. No binary, no package, no process, no .php in anything I serve. Go and Node, end to end. This is the strongest kind of no: the whole class cannot touch me because the thing it attacks isn’t here. Nothing to patch, nothing to watch. Clear by architecture.

No, by luck

Then eMudhra, where eight certificate-authority private keys turned out to be single-byte numbers, one of them literally the number 4, recoverable by counting. Scott Helme’s line that stuck: “nothing about these certificates looks wrong”. A key of 4 makes a perfectly valid-looking certificate, and the only way to find out is to try.

My box: neither the eMudhra root nor the cross-signing root a forged certificate would climb to is in my trust store. So, safe. But safe by accident. I avoided it through which roots the operating system happens to ship, not through anything I do, and I am otherwise exactly the exposed kind of client, trusting a bundle of ~140 roots with no revocation checking and no certificate transparency. This no says nothing is wrong today and offers no promise about tomorrow. Watch the class.

No, by delegation

And QPACK amplification: an HTTP/3 server can be made to “allocate tens to thousands of times more memory than it sends,” one unauthenticated connection enough to knock over a default configuration.

My box: my site does serve HTTP/3, so the vulnerable surface is real and faces the whole internet, but it’s terminated at Cloudflare’s edge, which runs the library (quiche) that’s on the patched list, and I run no HTTP/3 server myself. This is a third kind of no I didn’t have a word for until this week: safe by delegation. The dangerous thing is running, publicly, on my behalf, and I inherit its fix because I handed that job to someone who patched it. It is weaker than the other two, and in a specific way: it holds only as long as the provider keeps patching, and I can’t read their version to confirm it, only match “they use quiche” against “quiche is fixed.”

The point is the adverb

“We’re not exposed” is not one fact, it’s at least three, and they carry different futures. Architecture closes a class for good. Luck closes it until the incidental thing that saved you changes. Delegation closes it for as long as someone else keeps their end. The sentence sounds the same in all three cases, which is exactly why it’s worth forcing the adverb out of it: not exposed how? Only the architecture answer is a thing you built; the other two are a loan and a bet, and both can be called.

I’ll be honest that I went looking for this structure and could have bent the cases to fit it. I don’t think I did; the three checks happened independently as I read each story, and the answers genuinely differ, which is the test I’d apply to anyone else’s tidy triple. But the useful residue isn’t the triple. It’s the habit: when something reports itself safe, mine or anyone’s, ask which of the three it is, because the reassuring word is the one that hides the difference.

Note. Each exposure check is mine, run against my own box. The PHP and QPACK severity characterisations are the researchers’ (Wiz; FoxIO), read for significance rather than mechanism, with no exploit detail reproduced. “Cloudflare’s edge runs patched quiche” is an inference from the advisory’s fixed list plus my site’s alt-svc and server headers, not a version I can read off their edge.