Week of Oct. 19, 2026

The Trump administration is reportedly preparing to hire private debt collection agencies and resume involuntary collections on defaulted federal student loans in 2027, potentially bringing millions of accounts back into active recovery. The development could create new opportunities for the accounts receivable management (ARM) industry while raising questions about borrower protections, federal contracting and collection compliance.

On October 21, 2026, two critical security vulnerabilities were disclosed in PHP, a widely used programming language that powers millions of websites, including those built on WordPress.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, involved flaws in how PHP processes website requests and manages server memory. If exploited, these weaknesses could potentially allow unauthorized individuals to execute malicious code on a website's server, access sensitive information, or disrupt website operations.

Because these vulnerabilities affected PHP itself rather than a specific WordPress plugin or website, they posed a widespread security risk for websites using affected versions of the software.

The good news is that security patches have been released and successfully deployed by some hosting providers.

Hosting providers such as WP Engine responded quickly, implementing additional security protections while the necessary updates were being deployed. WP Engine confirmed that its PHP security updates were completed on October 21, resolving the vulnerabilities for websites running on its platform.

However, not all websites use the same hosting provider or PHP version, so it's important for organizations to confirm that their own systems have been updated.

Businesses are encouraged to contact their IT teams, website administrators, or hosting providers to verify that the appropriate security patches have been applied, particularly to any websites, client portals, or other systems that rely on PHP.

For additional information, visit WP Engine's official security update.

• Kroger Plans 3,000 Corporate Job Cuts as U.S. Employers Restructure Workforces
• GAO Finds Mortgage Trigger Leads Offer Limited Benefits as New Restrictions Take Effect
• Social Security COLA Set at 3.6% for 2027, but FERS Retirees Receive Less
• The Business of Bad Debt Advice: How Scams Exploit Consumers Struggling With Debt
• South Korea Debt Collection Outsourcing Surges 14.6% as Lenders Cut Costs
• Alabama Court Rejects I.C. System’s Bona Fide Error Defense in FDCPA Case

Last year, Adam Parks and Larry Costa discussed how collection agencies could grow beyond third-party collections. Now, Larry is back on the Receivables Podcast to share how collection agency diversification worked for Capital Management Services (CMS). The strategy worked. And the numbers back it up. Larry explains what it takes to manage these opportunities, why operational excellence matters, and how debt collection technology and skilled agents can work together.