It worked for years, until AI started looking

A PHP vulnerability remained unnoticed for about 14 years, and a Linux flaw for nine. The software kept running, so it was easy to assume all was well. AI is speeding up the search for old mistakes. What worked for years will not necessarily stay safe.

Old vulnerabilities are coming to light

Software	How long the flaw remained
OpenBSD	27 years
FFmpeg	16 years
PHP	about 14 years
Linux, Copy Fail	9 years
Linux, CVE-2026-31695	almost 5 years

These are not obscure hobby projects. Businesses, governments and much of the web depend on this software. Many developers worked on it, yet these flaws remained for years.

PHP: a flaw hidden for about 14 years

The vulnerabilities known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619, had been in the code since PHP 5.4 in 2012. A limited variant was found in 2024, but was not considered significant at the time.
In August 2026, research groups found the flaws with the help of AI. Events moved quickly. Within about a week, researchers had working attacks against WordPress and Drupal. Updates arrived on 21 October. Cloudflare saw tens of thousands of attack attempts within 45 minutes, and later millions. Palo Alto Networks counted 22.6 million potentially vulnerable installations.
In the Netherlands, government, healthcare and news sites temporarily went offline while they waited for patches. That was often a precaution, not evidence of a breach. On 22 October, the NCSC said it had not seen exploitation on Dutch websites.

Linux: the same pattern

Copy Fail, CVE-2026-31431, had been in the Linux kernel since 2017 and was found with the help of AI. It can let a regular user on the system gain root access. CVE-2026-31695 remained in the kernel for almost five years, and a working exploit has been reported. ZcopyReaper, CVE-2026-43502, dates back to kernel 4.17.
Newer flaws are also being found quickly. Fragnesia, CVE-2026-46300, was introduced by an earlier patch. It has been on CISA's known exploited vulnerabilities list since 28 October. It has been linked to PHP2Shell: an attacker enters through the website, then gains control of the server.

This is only the beginning

AI can speed up researchers and attackers alike. OpenAI acknowledges that the same capabilities can help attackers create attack tools quickly. The UK NCSC warned in May of a wave of urgent updates across many kinds of software, including open source and SaaS.
Nobody knows which product will be next. What is clear is that much old code has never been examined with today's tools. Expect more weeks like this.

What this means for your business

Perhaps your website has run for ten years without trouble. The same could be said of PHP before these flaws surfaced.
A vulnerability can expose customer data, take your shop or application offline, or give attackers control of your server. Then come customer questions, repair costs, lost revenue and possibly a notification to the regulator. Reputational damage often starts with a simple question: what happened to my data?
Attackers do not have to select your business individually. PHP2Shell attack attempts ran into the millions. Being online can be enough.

Your code and your server need different checks

PHP and Linux vulnerabilities require server updates. Flaws in your own website or application live in your code: a form that fails to validate input, a page without proper authorization, or a key committed to the repository. A supplier update will not fix those flaws.
It does not matter who wrote the code, or when. An attacker cares only whether the flaw works.

What a vulnerability can cost

The Dutch Data Protection Authority may impose a fine for inadequate security. Under Article 83 GDPR, a fine can reach €10 million or 2% of worldwide annual turnover, whichever is higher. In December 2025, HAN received a €175,000 fine after an attacker exploited a web form vulnerability in 2021. The authority examined issues including excessive access rights, limited logging and poorly protected passwords.

Documenting your security work

The GDPR and the Dutch Cybersecurity Act call for measures appropriate to the risks, not perfect security. Article 32 GDPR also mentions regular testing and evaluation of those measures.
The Cybersecurity Act has applied since 15 August 2026 and, according to the NCSC, affects more than 8,000 organisations. Article 21 addresses secure development, vulnerability handling and supply chain security, among other topics. Even if your business is outside its scope, a customer may ask you for evidence of your controls.
A code scan or server scan is no compliance certificate. A report can, however, help show what you checked, found and fixed.

What to do now

1. Check which PHP, Node.js and kernel versions are really running.
2. Patch and restart.
3. Replace software without support. PHP 8.2 will end on 31 December 2026.
4. Look for signs of abuse.
5. Have your own code checked, including the old parts that no one is looking at anymore.
6. Document what you have done.
Use our free self-check as a starting point.

How Binadit helps

Binadit Code Scan checks the source code of your website or application for a fixed price, without requiring an account. A server scan covers patch levels and configuration. We handle your code carefully, sign an NDA and have a person review each finding.

Explore Binadit Code Scan, server scans, or start with the free self-check.