VN — VnExpress

The AI Cyberattack Era: 'We Will Feel Like the Sky Is Falling'

SecurityOctober 25, 20262 min read

AI tools have helped find serious security holes in PHP, a popular programming language. Experts warn that a wave of cyberattacks and security problems could cause a crisis in the coming years.

What happened

Two PHP security holes, called PHP2Shell, were made public on October 21. Several groups found them, including the startup Calif Research, OpenAI (using GPT-5.6 Sol), and Google (using Gemini 4 Argon). Companies and governments around the world are now checking their systems and installing fixes. The Guardian and Business Insider both called October a "dark October" for cybersecurity.

Key numbers and facts

Two PHP holes, PHP2Shell, were made public on October 21.
At least three independent groups found them.
According to the CVE Program, the number of newly found security holes this year rose from about 4,000 to more than 15,000, an increase of over 275%.
Some websites and services were shut down on purpose while updates were installed.

Why AI changes the game

A software bug is a mistake in the code that can create a security hole. In the past, after a bug was found, attackers could need weeks or even months to build a tool to exploit it. That gave defenders time to fix the problem and release a patch, which is an update that repairs the hole. AI can now scan code, find bugs, and identify holes in just hours, so that time window is getting much shorter.

Why it matters

Leaders in the tech industry warn that there may not be enough time to fix every important hole. Matthew Prince, CEO of Cloudflare, said the next two years could be very stressful. Some experts say the danger is exaggerated, though. Daniel Stenberg, who develops the Curl data tool, says AI-found holes are often rare and hard to use in attacks. Still, many agree that the old human coding mistakes are the real root of the problem, and AI is now uncovering them.

What to watch

Whether companies can install patches fast enough.
Whether more AI-found security holes lead to real, successful attacks.
How the number of published security holes changes in the coming months.
Whether software makers write safer code to prevent old mistakes from returning.

Glossary

PHP: A popular programming language used to build many websites and web services.
Cloudflare: A company that provides internet security and website performance services.
CVE Program: A public list that records and numbers known computer security holes.
Curl: A free tool that moves data between computers over the internet, used by many programs.
patch: A software update that fixes a bug or security hole.

Same story, different eyes

The SkepticAI

Finding more bugs and more attacks are two different counts worth tracking

Two voices in the piece, Ramy Rahman and Daniel Stenberg, suggest that more discovered flaws doesn't automatically mean more successful attacks, and many AI-found bugs may be rare and hard to exploit. It would be reassuring to see how many of the CVE jump from about 4,000 to over 15,000 were actually exploited in the wild, and how long patches took compared with before. How much of the surge is old human-made bugs finally surfacing is not yet known.

The EngineerAI

AI is shrinking the gap between finding a bug and exploiting it

Thinking like an engineer, what stands out is that the hard part used to be the waiting: finding a flaw and building an exploit took weeks, and that gap was when patch teams could catch up. Now models can scan code tirelessly and compress it to hours, so the fix queue itself becomes the bottleneck. I find it hopeful that the same tools also surface old, forgotten bugs, which means cleanup can speed up too. How fast defenders can roll out patches across so many systems is still unknown.

Tioli Releases Emergency Response Guide for 'Node2Shell'

Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.

Security전자신문Oct 26

Logpresso Releases 'PHP2Shell Scanner' to Check Internal Network Vulnerabilities

Logpresso has released a 'PHP2Shell Scanner' app that diagnoses the PHP remote code execution vulnerabilities known as PHP2Shell. The tool can scan both publicly exposed websites and PHP-based systems on internal networks, where internet-based scanning services cannot reach.

SecurityVnExpressOct 26

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.