Faster than the fix
The interwebs has been busy recently, security-wise - there's enough goings-ons that I decided I wanted to write something about it. Vulnerabilities are being discovered at a somewhat alarming rate, a PHP hole took a chunk of the internet offline, and a certificate authority's private key turned out to be literally just 4. I wanted to share some thoughts on it, with the facts and figures to back them up.
TL;DR, if you read nothing else: stay safe, be careful what you click, install updates, turn on 2FA and be wary of internet gremlins.
The graph
Every security hole that gets found and confirmed ends up with a number. Whoever finds one reports it, either to the people who make the software or to one of the organisations allowed to hand out IDs. Big companies like Microsoft, Google and Apple issue their own, and MITRE picks up anything nobody else covers. They check it's a real flaw and not one already listed, then reserve an ID for it: CVE, the year, then a number. CVE-2026-109618, one of the PHP bugs further down, is an example. The details usually stay private until there's a fix, and then the record is published with a description, what's affected and usually a severity score out of 10.
CVE stands for Common Vulnerabilities and Exposures, the public list that tracks all these, run by MITRE since 1999. When anyone talks about patching a particular hole, the CVE is the identifier. This means the number of new CVEs can be used as a rough indicator of how many holes are being found and made public.
From 2022 to 2025 the yearly total steadily increased: 26,414, 30,949, 40,706, then 49,970, almost doubled in 3 years. 2025 averaged about 4,200 a month. 2026 started at 5,143 in January, then passed 10,000 in July and reached 15,066 in September - more than three times September of the previous year. With a week of October still to go, 2026 is on 87,130, already about 75% more than the whole of 2025. The numbers come from cvefind, and match the US National Vulnerability Database (run by NIST) to within a handful: September 2026 is 15,066 on one and 15,074 on the other.
More CVEs isn't the same thing as more danger. Part of the rise is simply more people (and more programs) looking. Some projects also give out a CVE for almost every bug they fix; the Linux kernel has done that since 2024, on the grounds that at its level nearly any bug might turn out to be usable in an attack (entirely fair - it's not always immediately clear how a vulnerability can be exploited). Google's threat intelligence group found that only 0.23% of this year's CVEs, about one in 431, have been seen exploited in the wild. The same report counted 141 flaws exploited in the first eight months of 2026, against 127 in the whole of 2025. So the number that matters is going up too, just much more slowly.
Why now?
AI models got good at finding bugs. In April Anthropic announced Claude Mythos Preview, a model it says can find and exploit vulnerabilities on its own, and decided not to release it publicly. Through Project Glasswing, companies like Microsoft, Apple and Google use it to find holes in their software before anyone else does. By Anthropic's own count it has turned up thousands of zero-days (flaws nobody knew about, so with no fix yet), including a 27-year-old bug in OpenBSD. These are the company's own claims, mind, but the numbers line up with independent data: Epoch AI counted about 2,500 high and critical CVEs from 21 large software organisations in July 2026, about five times the monthly record before April.
PHP2Shell
PHP runs a large part of the web: estimates put it behind about 70% of websites, from WordPress blogs to government portals, this site included. On 20 October the PHP project warned that an emergency release was coming the next day, for two flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10. Together they allow remote code execution (basically running whatever you want on the victim's machine), and the researchers at Wiz showed it working against fresh installs of WordPress, Drupal and Joomla. The code involved had been there for more than a decade, so nearly every PHP version back to 5.4 was affected by at least one of them.
Wiz found the first bug on 19 August, with help from two frontier AI models, and reported it to PHP five days later. The fix came out on 21 October. That gap is normal - a fix has to be written, tested and coordinated so the details don't leak first - but for two months the hole was known to a handful of people. If someone with worse intentions had found the same thing in that time, they'd have had a free run.
Offline on purpose
PHP2Shell gained a lot more visibility though, thanks to the PHP project's rather blunt advice:
There are no complete mitigations, updating is the only safe choice.
Immediately updating isn't always an option, systems might be tied to a specific compatible version, updating might break it. Some had nothing to update to: Detectify told The Record that roughly half of all PHP websites run versions that no longer get security fixes. The safe option for anything that couldn't update immediately was to simply go offline. Several governments took websites down before the fix was even released, and Nintendo, Berlin's Charité hospital and the OBS Project took services offline while they patched. Hundreds of websites were down that Wednesday.
They had good reason. Cloudflare sits in front of a large share of the web, and it saw thousands of attempts to exploit the flaws in the ten hours before the announcement, before there was a fix to install. Its chief executive, Matthew Prince, posted the rest: tens of thousands in the 45 minutes after, hundreds of thousands within two hours, then millions. Those are attempts rather than successful break-ins, and Cloudflare was filtering them for the sites behind it. Anything unpatched and not behind an equivalent filter...well, good luck.
Two days later PHP published a third issue, less likely to be exploited, along with a setting to switch off until the next release.
The private key was 4
The same week, a different kind of hole. A certificate authority is a company your browser trusts to vouch that a website is who it says it is - it underpins every HTTPS connection. eMudhra, an Indian certificate authority, had eight intermediate certificates whose private keys were meant to be random 384-bit numbers: there are more possible values than atoms in the universe. Every one of the eight was below 256. The smallest was 4. Scott Helme recovered all eight from the public certificates in under a second, on a laptop; this one needed no AI at all, just someone to look.
eMudhra says a flaw in its key generation in April 2025 produced the weak keys, so they were in the wild for about eighteen months. Anyone holding them could have issued a certificate for any website that browsers would accept. The fix was quick where it could be: Chrome blocked the certificates 100 minutes after the report, Firefox followed the same evening, and Apple and Microsoft within three days. Anything that doesn't update its own list of trusted certificates still trusts them. Certificates get burned all the time - that's what revocation lists are for. The problem is that these weren't website certificates, they were intermediates: certificates used to sign other certificates. It's a chain of trust, and these were links near the top of it.
The race
To me it feels similar to early antivirus: some new malware doing the rounds, someone writes a signature for it but the next piece of malware is already on the way. It's the cat and mouse back and forth trying to stay ahead. Both sides have always had the same tools - debuggers, fuzzers, the same published patches. What's changed is how much work a model can now do, and how quickly: a model that helps a defender find a bug before release helps an attacker find one after it. Every patch gives the game away too: compare the code before and after, and the hole is right there. Not a problem if everyone installs updates as soon as they are available, but that's not realistic. Google's report puts most of the rise in exploitation down to bugs that were already public and picked up quickly after disclosure, possibly with AI doing that comparison. One BeyondTrust flaw was being exploited four days after it was published.
The National Cyber Security Centre said much the same in May 2025: the time between disclosure and exploitation has shrunk to days, and AI will almost certainly shrink it further. It's only a matter of time before a bad actor finds a hole before a good actor can patch it. Until there's a fix, the only completely safe answer is the one the governments chose for PHP: unplug it. For a website that's an inconvenience. For other things, turning it off is simply not an option.
Artificial intelligence (AI) will almost certainly continue to make elements of cyber intrusion operations more effective and efficient, leading to an increase in frequency and intensity of cyber threats.
The things that can't just go offline
TV and film love to hack flood barriers, with the Thames Barrier an example that springs to mind. It's not just London though; water is everywhere (I guess it is kind of important now I think about it?). Pumping stations, reservoirs, treatment works are mostly unattended, and watched from a control room somewhere else - Yorkshire Water's 2024 tender for a new system describes the current one. It gathers reservoir levels, water quality and pump and valve status from thousands of remote assets in near real time, for a control room and for staff working remotely. Back in 2003, Thames Water's London control centre already ran more than 200 pumping stations, boreholes and unmanned treatment sites.
There are examples of how it can go wrong. In November 2023 attackers got into the controller at a remote station that regulates water pressure for two towns near Aliquippa, Pennsylvania - it had most likely been left exposed to the internet with a weak password, and crews ran it by hand until it was fixed. In April 2025 someone opened a valve at a dam in western Norway, and it took the operators about four hours to notice and close it. Nobody was hurt in either.
Power is the obvious one. In December 2015 attackers opened breakers remotely at three Ukrainian electricity companies, and about 225,000 customers lost power for between one and six hours. It was the first confirmed blackout caused by a cyber attack.
Then money. Cash was 8% of UK payments in 2025, so nearly everything else depends on card machines, banks and the networks between them. We've seen what happens when that stops, twice by accident. In the Iberian blackout of April 2025 card machines and cash machines stopped, and shops that could open went cash-only. The Bank of Spain found the payment systems themselves held up fine - it was everything around them that couldn't run without power. In July 2024 a faulty CrowdStrike update knocked out Windows machines worldwide, card payments in some shops among them.
An attack ends the same way, except the switch-off is deliberate. When M&S was hacked over Easter 2025 it turned off contactless payments, then online orders, and online orders didn't come back for seven weeks. It's the PHP choice again: if you can't trust a system, you turn it off. For one retailer that's expensive. For the payment network a whole country runs on, it would be a lot more than that.
Assuming a lag, or no change to cyber security mitigations, there is a realistic possibility of critical systems becoming more vulnerable to advanced threat actors by 2027.
Closer to home
This doesn't just apply at a national level. The same NCSC report above expects AI to make cyber attacks more frequent and more intense, and a lot of that lands on ordinary people. UK Finance counted £1.28 billion lost to payment fraud in the UK in 2025, across more than four million cases. Losses to fraud where someone is talked into sending the money themselves went up 19%, and two thirds of those cases started online. A website that misses a patch doesn't just go down either: it becomes somewhere to host a convincing phishing page or a download that isn't what it says. Pandora's box has been opened, and the tools that find holes aren't going back in it.
2-step verification isn't a force field either. On Discord, accounts with it switched on have been taken over all year. Once you're logged in, Discord keeps you logged in with a token, and whoever has that token is you - no password or code needed. Malware hidden in a "game" or cheat a friend sends you can copy it straight off your computer. Scanning a QR code someone sends you for free Nitro does the same thing more directly: Discord's QR login skips the password and any 2FA, so the scan logs them in as you. Each stolen account then messages its friends with the same bait, which is how it has reached tens of thousands of accounts this year.
Stay safe
None of this is a reason to unplug the router. The holes that make the news get fixed, often within a day of going public, and most of them are never used against anyone. The boring things still do most of the work. Turn on 2-step verification, on your email first, because whoever has your email can reset everything else. Install updates when they turn up rather than in three weeks. And think twice before you click: a message that wants you to act quickly is usually the one to leave alone. You are the best defence you have - question where a message really came from, even when it's from a friend, because their account may have been taken over too.
Where it ends up
None of the holes in this post are new. The PHP code had been sitting there for more than a decade, the OpenBSD bug for 27 years, and eMudhra's keys for eighteen months. What's new is that something is finally looking hard enough to find them. Every hole that gets found and fixed is one nobody can use later. The same models are being pointed at software by the people who wrote it, so more holes should be caught before release rather than after.
There's a storm to weather first, though. Fixes are arriving faster than a lot of systems can take them. Anything that can't be updated - the old phone, the unsupported server, the controller nobody remembers installing - stays open for as long as it stays online. The NCSC expects a digital divide between the systems that keep pace and a large share that don't. Even so, I think the interwebs that comes out the other side will be harder to break into than the one that went in. Until then, the boring advice above still stands - but also, here is Gary the slug.
