We fix whatever makes noise

I spent this week in Italy, in an ashram, on a spiritual retreat with my family. It is the week the cybersecurity industry chose to wake up all at once and declare a CVE bloodbath. In a few days, the keys of an Indian certification authority turned out to be computable in under a second, PHP and Node.js fixed on the same Wednesday two flaws that hand over a server, and a firewall flaw patched since May reappeared in the hands of ransomware groups. France, meanwhile, was still digesting the attack on its supermarkets' cold rooms.

The most instructive fact of the week appeared in no security advisory. It lay in how organisations behaved. For the PHP flaw, teams we normally have to fight to get an update out of did it without argument, asked to be allowed to do it and asked for advice. The usual objections had vanished. When we want to, we can. What is missing the rest of the time fits in one word, the will, and this week showed what triggers it: noise, far more than severity.

PHP2Shell, the flaw that got all the attention

PHP2Shell earned its noise. The two flaws affect the PHP engine itself, which runs a large part of the web, from WordPress to local authority portals, and let an attacker with no account at all execute their own code on the server. Rated 9.2 out of 10, they were exploited before they were even announced: the decoys Amazon places on the internet caught an attempt on 17 October, four days before the fixes were published. On 23 October, Unit 42, the research team at Palo Alto Networks, described an intrusion into a European public body. The attacker, an AI chaining the steps together itself, had collected passwords and two-factor secrets, then went for the directory that manages every account in the organisation, all in under two hours. At least one European government took its site offline as a precaution.

The triage, for its part, was rough. The most repeated figure of the week, more than 22.6 million « potentially vulnerable » servers, counts those running PHP without saying anything about which ones can actually be compromised. Red Hat, for that matter, rates the flaw only « important » on its systems, where the most common configuration makes exploitation difficult in practice. Everyone nonetheless received the same red alert, the one triggered by a flaw with a name, a score above 9 and a statement from every major vendor. That is precisely what was missing, the same day, from a flaw just as dangerous.

Node2Shell, the same day, under a different label

On 21 October, Node.js, the environment that runs JavaScript on the server side, also fixed a flaw in its decompression decoder that allows, according to the project itself, remote code execution. Researchers named it Node2Shell, in obvious echo of its neighbour. The consequence is identical, and Node.js nonetheless rated it « high » rather than « critical ». It drew little reaction, and that word has a lot to do with it: in most organisations I know, a critical flaw is fixed within days, a high one within several weeks. No attack had been reported by 24 October, even though proofs of concept were already circulating, and Node.js versions 20 and earlier will never be fixed.

That silence is all the more worrying because Node.js has become the foundation of much of what AI produces. The application generators of vibe coding, where you describe an application in plain language and a model writes it, ship React and Next.js by default, which run on Node.js, because the models have seen more of that code than any other. Part of what has gone live in recent months was therefore put there by people who never chose Node.js, do not know which version runs on their server and will never read a security advisory. A flaw labelled « high » in an environment whose operator does not know it exists triggers nothing at all.

A certification authority whose key was 4 complains about the noise

Node2Shell lacked noise because of a label. The eMudhra affair lacked it while touching something deeper still, the mechanism that lets us trust a website or a piece of software. A certification authority issues the certificates by which browsers, applications and devices verify that they are talking to the right server, or that the software they are installing really comes from its publisher. Whoever holds its private key can issue a certificate accepted for any domain and sit in the middle of a communication without raising an alert, or sign malicious software in the name of a legitimate publisher.

On Saturday 17 October, a researcher proved to Google and Mozilla that the private keys of eight intermediate certification authorities belonging to India's eMudhra could be recomputed in under a second from the public certificates. One was 4, the other seven were numbers below 256. Generated in April 2025, they had passed two independent audits and had enjoyed the trust of the major browsers for eighteen months, which blocked them within hours. For everything else, there is no dashboard. A great many pieces of software and equipment carry their own list of trusted authorities, frozen into containers and devices nobody rebuilds. No malicious use of the keys had been observed as of 21 October.

Media coverage stayed minimal, which did not stop eMudhra from complaining about it. Announcing on 22 October its withdrawal from the global web certificate market, a business its chairman puts at around 1 % of revenue, the company judged the amplification on social media out of all proportion, and the Indian ministry of information technology denounced alarmist accounts. A certification authority whose key was 4 therefore reproaches the noise for existing, when noise is the only signal capable of getting forgotten equipment updated.

Patched in May, exploited in October by ransomware

Three days before eMudhra's complaint, a firewall flaw showed what the absence of noise costs. It affects the VPN on Palo Alto Networks firewalls, the door through which remote workers enter their company's network, and allows it to be opened without credentials. The fix has existed since May, the US cybersecurity agency flagged it as exploited as early as 13 May, and the first intrusions were observed in June.

On 19 October, Unit 42 found that the Qilin and Inc ransomware groups now use it to break into corporate networks while bypassing two-factor authentication. They then work down to the virtualisation servers and on to the backups, the last line of defence when everything else has given way, helped along by a Veeam flaw published in 2023. The victims are in healthcare, energy, retail, public administration and transport, among others.

Palo Alto Networks speaks of limited attempts, against devices neither patched nor protected by the documented workaround. Five months after the fix, corporate VPNs were therefore still open to anyone who knew the flaw. It never received a name, and two days after the Unit 42 alert, the whole industry had its eyes on PHP.

Why does an exploited flaw stay open for months?

The case is in no way isolated. Last Sunday I described how around 700 supermarkets had their cold rooms thrown out of range remotely through Danfoss controllers their manufacturer no longer maintained. One figure has been added since: between 7 September and 6 October, a month after new flaws in those controllers were published, the insurer Coalition still counted 820 of them exposed on French networks, more than half of those it observed worldwide.

The decision gap, that distance between the moment a risk becomes known and the moment somebody deals with it, has no technical explanation here. Firmware is updated in one visit, a VPN in one maintenance window. The blockers are elsewhere, and I find them in almost every organisation. The first is inventory, because you do not update a device you do not know you have, and in September an insurer knew the exposed French refrigeration controllers better than their owners did. The second is ownership. Restarting the VPN cuts off remote work for the entire company, and the maintenance window is negotiated with business units that have no reason to give it up for a flaw nobody is talking about, while the refrigeration controller belongs to facilities and to a contractor whose contract rarely provides for any security monitoring at all. The third is measurement: the teams responsible for patching are judged on the number of critical flaws they close, which rewards whatever carries the label, whatever the real danger.

The PHP week supplied the counter-proof. Those three blockers gave way within days, at organisations that normally raise them against every update, as soon as the noise manufactured the will. Yet none of them is lifted inside the technical team. Taking inventory of facilities equipment, imposing a maintenance window on the business and changing how the work is measured are three management decisions, and until they are taken, the news cycle sorts in their place.

When AI finds 14,000 flaws in two months, who decides what gets fixed?

Sorting by the news cycle worked more or less as long as flaws arrived in a trickle, and that time is over. In August, Palo Alto Networks presented a system that hands vulnerability research to several AI models. In two months, it confirmed 14,090 of them across nearly 4,000 open source projects, almost all previously unknown and around 40 % of high or critical severity. Only 85 had already been reported by others, from which the vendor concludes that others are running the same hunt, attackers included. PHP2Shell itself was found with the help of AI models, including Google's Gemini.

Models write a growing share of web application code, find flaws in it by the thousand, and the attackers using them go from a web flaw to the directory managing every account on a network in under two hours. Against that, Palo Alto Networks puts the average time to deploy a fix at 55 days. The figure comes from a vendor selling the remedy, and the order of magnitude is nonetheless enough against an adversary counting in hours. When four discoveries out of ten come out labelled high or critical, the label no longer distinguishes anything, and the news cycle, which holds only a handful of flaws a week, will pick ever more arbitrarily which ones get dealt with first.

Making noise has become a management responsibility

The lesson of this fortnight fits in a sentence I repeat to the CISOs I work with: you have to make noise, because noise manufactures the will that is missing. The news cycle makes it for flaws that have a name and a press release. The CISO has to make it for the others, the firewall flaw exploited for five months, the device forgotten on the internet, the hardware nobody maintains any more, and that noise is built out of days of downtime, lost cold rooms and doors left open to ransomware.

Noise remains a lever, though, and management that acts only when the press gets involved has no will of its own. That is where the leadership crisis sits: a VPN unpatched since May is an accepted risk nobody signed. Last Sunday I wrote that we accept cyber risk the way we pick the plant in reception. The PHP week shows the other side of it. When management does not decide, somebody decides in its place, and management that lets the severity score and the trade press sort its patching has delegated its risk appetite to a formula and a newsroom. The NIS2 directive gives that decision to management bodies, a responsibility that never waited for transposition to exist.

AI now has a say at every technical step, from writing the code to running the intrusion. The only step still human is deciding what gets fixed first, and it is also the slowest.

What would actually protect

Making that decision faster than the news cycle requires neither a miracle tool nor a new law. The first rule is to set the urgency of a fix on two questions before looking at the score: is the flaw being exploited, and is the device visible from the internet? When the answer is yes to both, the fix or the workaround happens within 72 hours, and any delay requires a derogation signed by a member of the executive committee, dated and with a deadline attached. Under that rule, the VPN does not wait five months, and a flaw labelled « high » like Node2Shell moves to the front of the queue as soon as the first attack is observed.

That still requires knowing what is exposed. The inventory must cover technical equipment, refrigeration controllers and building management systems included, be checked each quarter from the outside and carry a named owner on every line, because an organisation that discovers its exposure in an insurer's report has already lost the race.

What the manufacturer no longer maintains deserves a register of its own. Old versions of PHP and Node.js, abandoned controllers, lists of trusted authorities frozen into devices: each line must go before the executive committee once a year and receive either a replacement date or a signed risk acceptance. Applications generated by AI belong there too, and none should go into production without the list of its components and their versions, failing which the one running on Node.js without knowing it will never receive the Node2Shell fix.

That leaves the indicator shown to management. The time between a flaw's first known exploitation and its fix on exposed devices should replace the number of critical flaws closed in the month, which measures only the team's activity.

On 13 May, the Palo Alto Networks VPN flaw was officially flagged as exploited. On 17 October, eMudhra's keys fell in under a second. On the 19th, Qilin and Inc appeared in the Unit 42 note. On the 21st, the whole industry was patching PHP. The next silent flaw may well touch an electrical substation or a water network, and the noise, that day, will arrive after it too.

Further reading

• We accept cyber risk the way we pick the plant in reception
• Parliament has never been your CISO
• The only backup that counts is the one you have already restored
• ReCyF, backdoors and USB sticks: France in cybersecurity, between clarity and anachronism
• Free: the fine is being argued at the Conseil d'État, the phishing carries on
• France's tax authority knew in late June. You found out on 13 August
• Practical steps to protect yourself on etrecyber.fr

Sources

• PHP, Security advisory: Critical remote code execution vulnerabilities, update now, 21 October 2026, and the release notes for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on the php-src repository.
• Palo Alto Networks Unit 42, Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619, updated 23 October 2026, for the agentic intrusion and the count of 22.6 million instances.
• Red Hat, CVE-2026-109618, security page, October 2026.
• Help Net Security, PHP2Shell: Critical PHP vulnerabilities patched, update now!, 21 October 2026, for the attempt caught by Amazon Threat Intelligence on 17 October; watchTowr, PHP2Shell FAQ, October 2026.
• Google Cloud, Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, October 2026.
• Node.js, security release of 21 October 2026 (versions 22.23.4, 24.22.1 and 26.12.1); Debian Security Tracker and OSV, CVE-2026-111497; Aikido Security, Node2Shell: Node.js Brotli vulnerability allows remote code execution, and Qualys, Node.js Patches Brotli Remote Code Execution Flaw, October 2026; Rescana, October 2026, for the exposure paths demonstrated by Imperva; Cybernews, October 2026, for the absence of observed exploitation.
• Vercel, Bolt.new and Lovable, default stacks surveyed by Fively, Best Tech Stack for Vibe Coding, and Appwrite, Best frontend frameworks for vibe coding, 2026.
• The Register, Indian certification authority eMudhra's private keys compromised, 20 October 2026, citing the announcement by Dennis Jackson (Mozilla), and Certification authority eMudhra defends its laughably weak private keys, 22 October 2026; Help Net Security, eMudhra security blunder left trusted CA signing keys exposed to anyone, October 2026, for the Mozilla incident report; The Record, Indian tech company eMudhra announces withdrawal from certificate business after security incident, and CyberScoop, October 2026, for the statement by V. Srinivasan, the Indian ministry's reaction and the CERT-In finding; Rescana and Endor Labs, October 2026, for the updates to trust stores outside browsers.
• Palo Alto Networks Unit 42, Active Exploitation of May 2026 PAN-OS CVE-2026-0257, updated 19 October 2026; CISA, Known Exploited Vulnerabilities Catalog, added 13 May 2026.
• Palo Alto Networks Unit 42, The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software, 4 August 2026.
• The Register, Researchers warned attackers could 'defrost the food' months before French supermarkets got hit, 15 October 2026, for the Coalition figures on exposed Danfoss interfaces.
• Directive (EU) 2022/2555 of 14 December 2022, known as NIS2, Article 20.