A Look At AI Security Gaps Across The Internet

🔍 Read the full analysis: A Look At AI Security Gaps Across The Internet on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get hardware and tech essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

A series of separate security disclosures and emergency responses converged in recent days, including fixes for critical PHP vulnerabilities and revelations about weak certificate authority keys, according to a report published October 22. The incidents affect different parts of internet infrastructure, and the report cautions that they did not all begin within the same 72-hour period.

PHP released fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS v4.0, according to the report. The patched upstream versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP describes the flaws as memory-safety failures involving invalid cleanup state and request-owned state that can persist into a later request on the same worker. Whether a system is exploitable depends on its deployment and reachable code paths.

The report says AWS observed exploitation attempts in its MadPot honeypots on October 17, four days before public disclosure. AWS assessed that PHP2Shell was being broadly exploited, while saying analysis of whether those early attempts would have succeeded against real systems was ongoing. The report also cites W3Techs data showing PHP on about 69.3% of websites whose server-side language it can identify; that figure is not a count of vulnerable or breached sites.

Other developments include an eMudhra certificate incident and government advice to address the PHP flaws. Researcher Scott Helme said eight compromised intermediate certificate authority keys had private values below 256, with one value reportedly just 4. A Mozilla incident record attributed the weak keys to a faulty hardware security module testing process and selection of incorrect key labels. It listed six TLS and two code-signing intermediates, with an initial migration estimate of about 30,000 certificates. The report also mentions a cloud provider acknowledging stolen data, a poisoned AI package, emergency Node.js updates and attackers using AI agents against websites, but supplies limited detail about those events.

Risks Beyond Website Logins

The incidents highlight that a website’s security depends on more than its application login screen. A vulnerable PHP runtime can sit beneath a content management system or online store; certificate trust depends on the keys and trust stores used by clients; and software packages or cloud accounts can introduce exposure through systems an organization relies on but does not directly control.

That creates practical work for operators: identify where affected software is running, apply fixes or vendor-supported mitigations, and check for signs of prior compromise. The report says agencies in the United States and United Kingdom advised inventorying PHP services and applying updates. They also described taking affected services offline as a possible response when timely mitigation is not available, rather than issuing an unconditional shutdown order for every site.

The claims about AI-enabled attacks add another concern, but the source material gives no incident details, scale or independent confirmation. The documented PHP and certificate issues have more specific technical descriptions. Readers should not treat the set of headlines as one coordinated attack or assume that every internet service is affected.

Several Different Failure Timelines

The incidents have distinct causes and timelines. The PHP flaws were publicly addressed October 21, while AWS reported seeing exploit attempts on October 17. According to the report, that means some operators may have faced exposure before the public disclosure, though the success of those early attempts against real systems remained under analysis.

The eMudhra certificate keys were associated with intermediates dating to April 2025, making that issue older than the recent cluster of headlines. Helme’s account describes the small private values, while Mozilla’s record attributes their creation to an HSM testing failure and a key-label selection error. Browser distrust mechanisms can reduce exposure, but the report warns that servers and applications may rely on different trust stores, including operating-system bundles, containers and custom certificate bundles.

The report frames the cloud data acknowledgment, poisoned AI package, Node.js updates and AI-agent attacks as further items in the same news cycle. It does not give dates, affected systems, technical findings or source links for those items in the supplied material. They should be understood as reported headlines rather than evidence that all listed problems share a cause.

“PHP2Shell is now broadly exploited in the wild.”

— AWS threat intelligence, as summarized in the report

Exposure and Impact Still Unclear

The number of systems actually vulnerable to the PHP flaws, the number successfully compromised and the success of AWS’s pre-disclosure observations against real targets are not established in the supplied material. PHP usage across identifiable websites is not equivalent to vulnerability or compromise, and the certificate migration estimate is not a confirmed count of affected end users.

The report provides few details about the cloud data theft acknowledgment, poisoned package, Node.js updates or AI-agent attacks: it does not identify affected services, victims, the extent of data or systems involved, or evidence connecting the events. It also does not establish whether the incidents are related. The consequences of the eMudhra certificate issue may vary across browsers and server-side applications because they can rely on different trust stores and validation behavior.

Patch, Verify and Review Systems

Operators using PHP should consult the applicable vendor advisory, identify exposed deployments and move to a patched release or vendor-supported backport. The report says temporary configuration changes and request filtering may block particular exploitation paths, but they do not fix the underlying defects. Administrators should verify that running workers have restarted on the fixed build and review logs and systems for possible compromise, especially where exposure may have begun before disclosure.

Organizations should also review whether their software or services rely on affected certificate chains and check the trust stores used by browsers, operating systems, containers and applications. The report does not provide a timetable for further findings on the cloud, package, Node.js or AI-agent items. More specific advisories and technical disclosures will be needed to establish their scope and the actions affected users should take.

Key Questions

Did all of these security incidents happen within 72 hours?

No. The report says the disclosures and responses converged in recent days, but the underlying issues have different timelines. It dates the eMudhra intermediates to April 2025 and says AWS observed PHP exploit attempts on October 17, before PHP’s October 21 fixes.

What should a PHP site operator do?

Identify the PHP runtime and deployment, follow the relevant vendor advisory, and update to a fixed release or vendor-supported backport. The report says to verify that running workers have restarted on the patched build and review for signs of compromise. Temporary settings are not a replacement for fixing the runtime.

Does the 69.3% figure mean that most websites are vulnerable?

No. The cited W3Techs estimate refers to the share of websites with an identifiable server-side language that use PHP. It does not measure how many sites run affected versions or have been compromised.

Were 30,000 eMudhra certificates confirmed compromised?

The report describes about 30,000 as an initial migration estimate in a Mozilla incident record. It does not establish that every certificate was compromised, or that all certificates ever issued by eMudhra were affected.

Are the AI-related attack reports connected to the PHP and certificate issues?

The supplied material does not establish a connection. It mentions attackers using AI agents against websites and a poisoned AI package but gives too little detail to confirm the scope, attribution or relationship to the other incidents.

Source: ThorstenMeyerAI.com