VN — VnExpress

48 Hours Without Sleep for Cybersecurity Experts

SecurityOctober 24, 20261 min read

Security experts stayed up for two days to patch a hidden flaw in PHP, a programming language used by about 70% of websites. Two flaws, called PHP2Shell, could let hackers run code on any PHP server without logging in.

A race to patch

After two PHP flaws called PHP2Shell were made public on October 21, many companies and governments rushed to install security fixes. The flaws let attackers run code on a PHP server from far away, without needing a password. That could let them steal data and read private information.

Key numbers

About 70% of websites worldwide run on PHP.
Cloudflare's CEO said attack attempts rose from thousands to millions in about two days.
Over 200 proof-of-concept (PoC) test exploit codes had been found by Palo Alto Networks.
Nine major security firms had not yet seen a successful real-world attack as of October 23.

Why the flaws were hidden

The flaws had been inside PHP code for years. They were very hard to use, so most people ignored them. AI helped find them, which is why experts say the threat feels new and urgent.

Why it matters

Many websites run on PHP, including government, bank, airline, rail, and tax sites. Some had to shut down to check their systems and install fixes. Experts say the speed of AI-driven attacks is changing how fast companies must respond.

What to watch

Whether hackers turn the test codes into real attacks.
Whether companies can confirm that no data was stolen before the patches were installed.
How long the problem lasts, since experts say it may drag on.

Glossary

PHP: A programming language used to build many websites.
PHP2Shell: The name of two security flaws in PHP that let attackers run code remotely.
Cloudflare: A company that helps protect and speed up websites.
Palo Alto Networks: A cybersecurity company that studies online threats.
PoC: Proof of concept; a test code that shows how a flaw could be used to attack.

Same story, different eyes

The EngineerAI

A patch rollout is really a hunt for what already slipped out

What stands out to me as an engineer is that installing the patch is the easy part. The slow part is checking that no data or system was touched before the fix, and that still takes a lot of manual work even with good deployment tooling. It's also striking that bugs hidden for years were found by AI, which means defenders and attackers now start the race from the same line. How quickly real-world attacks will actually succeed is still not known.

The UserAI

Patching is the easy part; proving nothing leaked is where the sleepless hours go

What caught my eye as a working professional is Woodhead's point that installing the patch isn't the hard part. Checking that no data or system was exposed before the fix is what eats the hours, and it still takes a lot of manual work even with good deployment tools. If you work in IT or security, expect your next few weeks to be about those checks and follow-ups, while for most other people the impact is mostly a few temporarily closed services. Experts say real attacks have been hard to pull off so far, so this may simmer for a while rather than blow up, though how long that lasts isn't known yet.

The SkepticAI

Millions of attempts, yet no confirmed successful attack: what would settle it

The picture feels a bit split to me: millions of exploitation attempts on one side, and nine major security firms reporting no successful attacks as of 23/10 on the other. It would help to see whether those attempts were mostly automated scanning, and how the 200+ proof-of-concept exploits Palo Alto Networks mentioned behave against hardened sites. It also seems worth watching whether the slow-burn scenario Don Smith described plays out in the coming weeks. How much of the surge came from AI-assisted attackers is not yet known.

Tioli Releases Emergency Response Guide for 'Node2Shell'

Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.

Security전자신문Oct 26

Logpresso Releases 'PHP2Shell Scanner' to Check Internal Network Vulnerabilities

Logpresso has released a 'PHP2Shell Scanner' app that diagnoses the PHP remote code execution vulnerabilities known as PHP2Shell. The tool can scan both publicly exposed websites and PHP-based systems on internal networks, where internet-based scanning services cannot reach.

SecurityVnExpressOct 26

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.