Why The Internet Is Struggling With AI Security

🔍 Read the full analysis: Why The Internet Is Struggling With AI Security on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the little things that make your day delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

A cluster of recent security disclosures—including critical PHP vulnerabilities, weak certificate-authority keys and a cloud provider’s acknowledgment of stolen data—has renewed concern about how internet services are protected. The incidents have different causes and timelines, and the available source does not establish that they are all connected to AI attacks; together, however, they show how security depends on software and trust systems beyond a site’s login page.

PHP released fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0, according to the source. Fixed upstream releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP advisories describe memory-safety failures involving request initialization and state that can persist between requests handled by the same worker. Whether a system is exploitable depends on its deployment and reachable code paths.

AWS said its MadPot honeypots recorded attempted exploitation on October 17, four days before public disclosure. AWS assessed that exploitation was widespread, while noting that analysis of whether the early attempts would have succeeded on real systems was still underway. That leaves the timing of potential exposure important for administrators: applying a fix may need to be paired with a review for signs of compromise. W3Techs estimates PHP is used by about 69.3% of websites where it can identify the server-side language; that figure is not a count of vulnerable or compromised sites.

The source also describes an eMudhra certificate incident, a poisoned AI package, emergency Node.js updates, a cloud provider’s disclosure of stolen data, and attackers using AI agents to target websites. It gives limited detail on those latter events, so their scale, targets and connections to one another cannot be established here. In the eMudhra case, researcher Scott Helme reported that eight intermediate certificate-authority keys had private values below 256, including one with a value of 4. Mozilla’s incident record attributes the weak keys to a faulty hardware security module testing process and says the intermediates included six TLS and two code-signing certificates.

Security Risks Beyond the Login Page

The PHP flaws illustrate why application-level defenses cannot address every risk. A security plugin or a site’s authentication system cannot fix a defect in the PHP runtime beneath the application. Likewise, a certificate can be distrusted by a browser while remaining trusted by a server-side program that relies on a different certificate store. Administrators may need to check operating-system bundles, containers, language environments and custom trust configurations separately.

The incidents also show how interconnected online services are. Websites rely on runtimes, package registries, certificate issuers, cloud infrastructure and software update systems maintained by different organizations. A weakness in any of these layers can affect the reliability of services that depend on them. The source’s reference to AI agents adds a further concern, but does not provide enough detail to measure their role or establish that AI caused the other reported failures.

For readers, the immediate practical implication is that security announcements may call for action outside routine application updates. Organizations need to identify which components they actually run, apply vendor fixes where relevant, and check whether systems were exposed before a fix became available. A raw count of affected certificates or websites cannot be inferred from the source’s figures.

Several Incidents, Different Timelines

The developments did not all begin in the same week. The eMudhra intermediates dated to April 2025, according to the source, making that problem a longer-running trust issue. The PHP fixes were released on October 21, 2026, while AWS reported seeing attempted exploitation four days earlier. The report groups these developments because their disclosures and responses converged, not because it establishes a common cause.

Government agencies cited in the source urged organizations to inventory PHP services and apply updates. The U.S. National Security Agency and the U.K. National Cyber Security Centre advised considering taking affected services offline if updates or other mitigations could not be implemented promptly. Jiji Press reported that Japan’s Prime Minister Sanae Takaichi similarly advised preparation for patching and said temporarily suspending website functions could reduce risk when an immediate patch was unavailable. These are conditional recommendations, not evidence of a universal shutdown order.

The source also cautions against treating configuration workarounds as a replacement for a fixed runtime. Setting PHP’s memory_limit to -1 may remove one attacker-controlled trigger, but also removes the configured memory cap and does not eliminate all allocation failures. Disabling session upload progress and restarting workers may block described exploitation paths; it does not repair the underlying flaws. Operators are advised to follow the relevant vendor guidance and confirm workers are running the patched build.

Scope and Exploitation Still Developing

The source says AWS observed exploit attempts before the PHP disclosure, but does not establish whether those attempts succeeded against real systems. Exploitability varies by deployment, and the number of affected or compromised PHP websites is not provided. W3Techs’ usage estimate describes sites where a server-side language could be identified; it does not measure exposure.

For eMudhra, the source reports an initial migration estimate of approximately 30,000 certificates, not that every certificate the company ever issued was compromised. The effect of browser distrust measures may also differ from server-side validation, which can rely on separate trust stores. Details about the cloud data theft, poisoned AI package, Node.js updates and AI-agent attacks are too sparse in the supplied material to confirm their scale, impact or relationship to the PHP and certificate incidents.

Patch, Check, and Track Advisories

Organizations running PHP should identify exposed services, follow the official advisory for their deployment, install a fixed release or vendor-supported backport, and restart workers so the updated runtime is active. Where immediate patching is not feasible, the cited U.S. and U.K. guidance calls for vendor-supported mitigations and consideration of taking affected services offline. Administrators should also review logs and other evidence for possible compromise during the exposure window.

Certificate users should check Mozilla’s incident record and assess the trust stores used by their applications, rather than relying on a single browser or command-line test. Further details would be needed to assess the reported package poisoning, cloud data theft and AI-agent activity. The next useful milestones are updates from the affected vendors and agencies, clearer findings on real-world PHP exploitation, and confirmation of remediation across affected systems.

Key Questions

Is this one coordinated AI security incident?

The source describes separate incidents with different causes and timelines. It mentions attackers using AI agents, but does not establish that AI connects or caused the PHP, certificate, cloud and package events.

What should organizations using PHP do?

Identify PHP services, follow the relevant vendor advisory, install a fixed release or supported backport, and restart workers. If a prompt update is not possible, consult vendor guidance on temporary mitigations and whether the affected service should be taken offline.

Does the reported PHP usage figure mean most websites are vulnerable?

No. The approximately 69.3% figure is W3Techs’ estimate of PHP use among websites whose server-side language it can identify. It is not an estimate of vulnerable or compromised sites.

Were 30,000 eMudhra certificates confirmed compromised?

No. The source describes approximately 30,000 as an initial migration estimate. It does not say that every certificate issued by eMudhra was compromised.

Source: ThorstenMeyerAI.com