Binadit · 3 November 2026

Things went well for years, until AI started looking into why old leaks are now a risk to your company

The leak in PHP was there for about 14 years. A leak in Linux 9 years. All the while, the software just kept spinning and everything seemed to be going well. Until AI made the search for mistakes much faster. This changes a fixed assumption of many entrepreneurs: what went well for a long time does not continue to go well on its own.

OpenBSD, 27 years

FFmpeg, 16 years old

PHP, about 14 years

Linux, Copy Fail, 9 years

Linux, CVE-2026-31695, almost 5 years

Old mistakes are now coming to the surface

This is not an unfamiliar hobby software. It is software on which companies, governments and a large part of the web run. Thousands of developers looked at it, and yet these mistakes lingered for years.

PHP: 14 years of nothing going on

The leaks that became known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619, had been in the code since PHP 5.4 in 2012. A limited variant was already found in 2024, but was not considered important at the time. In August 2026, research groups found the errors with the help of AI. Then it went fast. Within about a week, there were working attacks on WordPress and Drupal ready in the investigation. On October 21, the updates arrived, and Cloudflare saw tens of thousands of attack attempts, later millions, within 45 minutes. Palo Alto Networks had 22.6 million potentially vulnerable installations. In the Netherlands, government, healthcare and news sites went temporarily offline in anticipation of the patches. Going offline doesn't mean a site was hacked, it was often a precaution. On 22 October, the NCSC said it had not yet seen any abuse on Dutch websites.

Linux: same pattern

Copy Fail, CVE-2026-31431, had been in the Linux kernel since 2017 and was found with the help of AI. This allows an ordinary user to become root on the system. CVE-2026-31695 was in the kernel for almost five years, and a working exploit has now been reported. ZcopyReaper, CVE-2026-43502, has been around since kernel 4.17. Recent errors are also more noticeable. Fragnesia, CVE-2026-46300, is not an old leak but came in via a previous patch. It has been on the CISA active abuse list since October 28. There it is linked to PHP2Shell: first through the website, then full control over the server.

This is just the beginning

AI not only makes researchers faster, but also attackers. OpenAI itself acknowledges that the same capabilities can help attackers to quickly create attack tools. The British NCSC already warned in May of a wave of urgent updates in all types of software, including open source and SaaS. No one knows which software is next. However, it is clear that there is still a lot of old code that has never been looked at as thoroughly as is possible now. So count on more of these kinds of weeks.

What this means for you as an entrepreneur

Maybe you think: my website has been running for ten years without any problems. That's what a lot of the web said about PHP. A leak can mean that customer data is on the street, your webshop or application goes down, or attackers take down your server. This is followed by questions from customers, repair costs, missed sales and sometimes a report to the regulator. Reputational damage often starts with one message from a customer: what happened to my data? Attackers don't have to choose you. At PHP2Shell, the attempts went into the millions. So you're not a target because you're tall, but because you're online.

Your code and your server are two different problems

You can fix leaks in PHP and Linux on the server. The errors in your own website or application are in your code: a form that does not check input, a page without authorization, a key in the repository. No update from a supplier will fix it. It doesn't matter who wrote the code. Whether it's ten years old or made last week, an attacker is just checking to see if it's working.

What a leak can cost

In the event of insufficient security, the Dutch Data Protection Authority may impose a fine. Under Article 83 GDPR, it can be as high as €10 million or 2% of global annual revenue, whichever is higher. In December 2025, the HAN was fined €175,000. An attacker had abused a leak in a web form in 2021. The AP then looked at security, such as excessive rights, limited logging and poorly secured passwords.

Your obligation to make an effort under the GDPR and NIS2

The GDPR and the Cybersecurity Act do not require perfection. They ask for appropriate measures that match your risks. Article 32 GDPR also mentions a procedure to test, assess and evaluate measures at regular intervals. The Cybersecurity Act has been in force since 15 August 2026 and, according to the NCSC, affects more than 8,000 organisations. Article 21 mentions, among other things, safe development, response to vulnerabilities and supply chain security. If you do not fall under it yourself, a customer who does fall under it can still ask for proof. A code scan or server scan is not a quality mark. However, a report helps show what you have checked, what you have found and what you have solved. Especially when something does happen, it is valuable.

Time to take action

1. Check which PHP, Node.js and kernel versions are really running. 2. Patch and restart. 3. Replace software without support. PHP 8.2 will end on 31 December 2026. 4. Look for signs of abuse. 5. Have your own code checked, including the old parts that no one is looking at anymore. 6. Capture what you've done. Use our free self-check as a starting point.

How Binadit helps

With Binadit Code Scan we check the code of your website or application, at a fixed price and without an account. With the server scan, we also look at patch level and configuration. We handle your code with care, sign an NDA, and each finding is reviewed by a human. VIEW THE PACKAGES

View Binadit Code Scan Have your website scanned Have your application scanned View the server scan Free self-check Conditions