In the last 24 hours, there has been a significant surge in cybersecurity events. Serious security issues have been identified across various domains—from website software and digital certificates to artificial intelligence tools and cloud platforms. Among the discovered flaws were vulnerabilities allowing attackers to execute their code on servers, as well as instances of malicious code injection directly into software updates.
One of the high-profile incidents involved the digital certificates of the Indian company eMudhra, which drew the attention of the global cybersecurity community.
This raises the question of why such a large number of problems occurred simultaneously. Previously, AI leaders warned that powerful AI models are capable of finding software flaws much faster than humans. The public fears that if the speed of AI vulnerability detection surpasses the speed of remediation, the security and privacy of users worldwide will be at risk.
These incidents once again demonstrated that internet security does not depend solely on one company or website. Trust in the internet is maintained by the interaction of multiple components, such as browsers, servers, software updates, and digital certificates. A failure in any of these elements can affect other services and companies. Although no major losses have been reported so far, further assessment of the situation is required.
The most significant event was the discovery of two critical vulnerabilities in the PHP programming language. PHP is widely used for creating websites and web applications, and many servers run on this platform. The Indian cybersecurity agency CERT-In issued a warning about these vulnerabilities on October 21, assigning them the identifiers CVE-2026-109618 and CVE-2026-109619.
By exploiting these vulnerabilities, attackers could execute their code on certain weak servers without needing authorization. This created a risk of gaining control over the server and impacting the services running on it. The PHP team released new security updates to fix these flaws: 8.5.12 for PHP 8.5, 8.4.27 for PHP 8.4, 8.3.36 for PHP 8.3, and 8.2.35 for PHP 8.2. Users of affected sites and servers were advised to promptly install the relevant updates.
Following the disclosure of the risks, attacker activity increased significantly. According to a Reuters report from October 22, Cloudflare recorded a sharp spike in attempted attacks on PHP after the vulnerability information became public. If such attempts previously numbered in the thousands, they reached millions after the disclosure. Many government agencies and companies in different countries began accelerating the checking of their systems and applying security updates.
Nevertheless, attempting to attack a system and successfully stealing data are two different processes. Initial reports have not confirmed any large-scale successful attacks related to this incident.
The history of PHP vulnerabilities also includes an aspect related to artificial intelligence. According to OpenAI, one of the critical vulnerabilities was discovered using GPT-5.6 Sol as part of the 'Patch the Planet' initiative. Independently, the company Wiz also discovered and reported both vulnerabilities. Subsequently, the PHP team and other security companies worked together to fix them.
This case demonstrates that artificial intelligence can be used not only for generating content or answering questions but also for finding hidden vulnerabilities in software. Such technologies can help security teams identify flaws and develop solutions more quickly. However, there is a downside: if attackers begin using similar methods to find vulnerabilities, prepare attacks, and identify weak systems, the reaction time of companies will decrease. Therefore, there is growing concern that attacks may become faster, despite hopes of strengthening cybersecurity with AI.
Concurrently, an issue arose concerning the digital certificates of the Indian company eMudhra. This company issues digital certificates used to ensure secure connections on the internet. Such certificates help browsers determine if a website is trustworthy and guarantee that the secure connection is directed to the correct resource.
According to CERT-In, eight intermediate eMudhra certificates had a vulnerability where their private cryptographic keys were generated in an insecure manner. These keys...