EXPLORINEER
en

DE — heise online

"Valley of Tears": Why Attackers Currently Have the Upper Hand on Security Flaws

Security2 min read

A German government cyber expert says attackers now have the upper hand when software has security holes. Attacks can be built within minutes or hours, while fixing them often takes much longer.

A serious PHP security hole

A serious security hole was found in PHP, a programming language used by many websites. Daniel Gille, a department head at Germany's Cyber Agency, told the German Press Agency that the world may be in a 'valley of tears' right now. This means a hard period for security that could last a while.

Key facts

  • Attackers can study a published security hole and build an attack in minutes or hours. In the past, this often took weeks or months.
  • Many website operators took their sites back online only after hours or more than one day, after installing updates.
  • Germany's Federal Office for Information Security rates the PHP risk as extremely high.
  • IBM's X-Force team counted at least 10,124 publicly known security holes from January to September this year. That is about 578 percent more than in the same period last year.
  • More than half of these holes, which were found using AI, were rated high or critical risk.

Why fixing is slow

Attackers can act fast, but fixing is slow. Each system owner must install updates on their own, so the repair spreads out over time. Some experts also think AI could help write safer software in the future. The Cyber Agency plans a research program on this, and it also studies the idea of using AI as the base of an operating system.

Why it matters

If attackers are faster than defenders, more systems are at risk for longer. Organizations that run websites and government services need to update quickly. The experts say the answer is not clear yet, and even the research on new system designs is still open.

What to watch

  • Whether the Digital Ministry finds that any data was stolen in the PHP case.
  • Whether the Cyber Agency's planned research program on safer software is announced.
  • Whether the number of publicly known security holes keeps rising in the coming months.
  • Whether the idea of an AI-based operating system gets real support among experts.

Glossary

PHP
A programming language used to build many websites.

Same story, different eyes

More in this topic

Security전자신문

Tioli Releases Emergency Response Guide for 'Node2Shell'

Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.

SecurityVnExpress

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.

Security전자신문

Election Deepfakes Up 27% Worldwide; South Korea Ranks Third in Cumulative Cases

Reported AI-generated election deepfakes surged worldwide, with January to September 2026 cases already exceeding last year's full-year total by 27%, according to a Surfshark study. South Korea ranks third globally in cumulative cases with 16 since 2021, behind the United States and India. The study counted 235 cases across 46 countries from January 2020 to September 2026.