PHP
AI-assisted discoveryPHP patched CVE-2026-109618 and CVE-2026-109619 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Calif discovered the issues in August; coordinated disclosure followed in October.
Primary source ↗ RESEARCH 002 / THE RESPONSE GAP
2024 → 2026 · Public-source research · Updated Oct 22, 2026
Protico - Community Intelligence
PHP, Node.js and certificate security alerts. In the AI era, how much time do businesses have to respond?
October 2026 brought PHP and Node.js security updates and the eMudhra intermediate-certificate incident. Protico Labs traces the timelines alongside public vulnerability data, AI-assisted research and business costs, examining the work between an initial alert and a completed response.
Explore the data ↗Hear about future risks early with Community IntelligenceTHREAT SIGNAL / 2024–2026
+361.3%
Oct 1–21, 2026 · vs the same days in 2025
2,719 → 12,543
Monthly vulnerability disclosures2024 → 2026
THE RESPONSE GAPData through 2026.10.21 · Updated 2026.10.22
01 / CONTEXT
48 hours of alerts across global internet infrastructure.
On October 20–21, 2026, PHP and Node.js security updates and the eMudhra intermediate-certificate incident were disclosed, affecting website operations, connection trust and application updates. Teams faced response demands across several layers of infrastructure at once.
eMudhra
Cross-product trust updatesWeak keys for eight intermediate certificates triggered updates across browsers, systems and website connections.
Primary source ↗Node.js
Four high-severity vulnerabilitiesTen CVEs: four high, three medium and three low, including Brotli remote code execution, CVE-2026-111497. Releases 26.12.1, 24.22.1 and 22.23.4 also update dependencies and certificate trust.
Primary source ↗These announcements cover software fixes, certificate-trust changes and dependency updates. The Node.js release also includes the eMudhra trust update.
02 / OBSERVATORY
AI models keep advancing. Vulnerability disclosures are accelerating.
NVD published 12,543 CVE records from October 1–21, 2026, compared with 2,719 in the same days of 2025—about 4.6 times as many. The chart places 33 complete months, October through the 21st and AI model releases on one timeline. The hatched October bar shows the month in progress.
+361.3%Oct 1–21, 2026vs Oct 1–21, 2025
Published vulnerabilities
2,719 → 12,54312,543
CVE publications this month
Oct 1–21, 2026 · UTCPublished CVE records / New records2024.01 — 2026.10 · through Oct 21
NVD publication-date queries with noRejected. October runs through the 21st (UTC); backfilled records and status changes can revise counts. Hatched bar: October 1–21 total. The 3-month moving average ends in September.
Inspect values and missing data
| Period | CVE | CISA KEV | Cumulative CVE |
|---|---|---|---|
| 2024-01 | 2,594 | 21 | 2,594 |
| 2024-02 | 2,778 | 9 | 5,372 |
| 2024-03 | 3,309 | 10 | 8,681 |
| 2024-04 | 3,621 | 10 | 12,302 |
| 2024-05 | 4,999 | 14 | 17,301 |
| 2024-06 | 3,078 | 9 | 20,379 |
| 2024-07 | 3,113 | 14 | 23,492 |
| 2024-08 | 2,896 | 19 | 26,388 |
| 2024-09 | 2,514 | 25 | 28,902 |
| 2024-10 | 3,564 | 17 | 32,466 |
| 2024-11 | 4,056 | 22 | 36,522 |
| 2024-12 | 3,431 | 16 | 39,953 |
| 2025-01 | 4,275 | 14 | 44,228 |
| 2025-02 | 3,673 | 27 | 47,901 |
| 2025-03 | 3,998 | 32 | 51,899 |
| 2025-04 | 4,034 | 15 | 55,933 |
| 2025-05 | 3,980 | 24 | 59,913 |
| 2025-06 | 3,681 | 20 | 63,594 |
| 2025-07 | 3,776 | 20 | 67,370 |
| 2025-08 | 3,628 | 15 | 70,998 |
| 2025-09 | 4,321 | 16 | 75,319 |
| 2025-10 | 4,273 | 31 | 79,592 |
| 2025-11 | 3,021 | 11 | 82,613 |
| 2025-12 | 5,491 | 20 | 88,104 |
| 2026-01 | 4,302 | 17 | 92,406 |
| 2026-02 | 4,616 | 28 | 97,022 |
| 2026-03 | 6,234 | 26 | 103,256 |
| 2026-04 | 5,810 | 31 | 109,066 |
| 2026-05 | 6,936 | 21 | 116,002 |
| 2026-06 | 7,942 | 23 | 123,944 |
| 2026-07 | 9,770 | 26 | 133,714 |
| 2026-08 | 12,258 | 31 | 145,972 |
| 2026-09 | 14,933 | 43 | 160,905 |
| 2026-10 · Oct 1–21 · month in progress | 12,543 | 24 | 173,448 |
CVE: NVD API publication-date queries. KEV: official CISA catalog. Retrieved October 22, 2026; October counts run through the 21st (UTC), with the same 21 days compared across years.
Inspect the months around a model milestone
Selected model announcements and access milestones; access types and dates are linked to their sources.
Mean: 3 complete months before3,683.72024-10 → 2024-12
Mean: 3 complete months after3,901.72025-02 → 2025-04
Change · CVE+5.9%open weights + API
Compare mean additions across three complete months on each side of the milestone, with the release month set aside. This descriptive view shows nearby changes; methodology details the variables for further analysis.
03 / THE RESPONSE CLOCK
The vulnerability was found. What happened before the patch?
Calif used GPT-5.6 Sol to research PHP vulnerabilities. Between discovery in August and the patch release in October, researchers and maintainers reported the findings, reproduced the issues and coordinated the release. The timeline shows when each step happened.
81days
PHP case: calendar interval from discovery on Aug 1 to patching on Oct 21, 2026.
The discovery-to-patch interval in this case is 81 days. Timeline compiled from Calif, CERT-EU and OpenAI.
04 / GLOBAL CASES
From Taiwan to the world: shared risks across business services.
91APP reported an attack on its commerce database. Zeabur described an incident across deployment regions, while Railway disclosed possible access to environment variables. Together, the cases connect familiar business services in Taiwan with the cloud infrastructure and credentials that support them.
91APP
91APP reported automated attacks on its Commerce Cloud database and access to some information.
The company began an external investigation and emailed affected customers with assistance.
Primary source ↗Zeabur
Zeabur confirmed access to environment variables and account data, identifying incomplete internal credential rotation.
The incident spanned deployment regions and included credentials and API keys for upstream services.
Primary source ↗Railway
Railway said an unauthorized party may have obtained some decrypted environment variables.
October 22 update: Railway reset bucket credentials. Users must redeploy bucket services, reconnect GitHub and revoke the registry tokens removed from Railway through GitHub itself.
Primary source ↗ · Railway · 2026.10.22 ↗JAPAN / 2026.10.21
A cybersecurity warning from Japan’s prime minister.
On October 21, 2026, Prime Minister Sanae Takaichi issued a public warning on X. She urged website operators to check their use of PHP and prepare to apply patches for two serious vulnerabilities, scheduled for release at 23:00 Japan time that night.
Read the original post ↗
05 / SPENDING & INCIDENT COSTS
Security spending is forecast to grow. Companies report incident costs.
IDC’s market forecast, the IBM/Ponemon breach study and M&S results describe annual security spending, average breach costs and one company’s recovery expenses.
Sources checked: 2026.10.22
MARKET FORECAST
Forecast annual global security spending
IDC published these forecasts for security products and services on March 3, 2026. Its 2029 estimate is about 40% above the 2026 figure.
IDC · 2026.03.03 ↗REPORTED INCIDENT COSTSIBM / Ponemon · 2026 sample study M&S · year ended 2026.03.28
Average breach costs and recognized company expenses
Sample average cost per data breach
US$4.99MThe study covers 602 organizations that experienced breaches between March 2025 and February 2026. AI-enabled malicious breaches in the sample cost an average of US$6M.
IBM · 2026.07.29 ↗Recognized incident-related costs
£131.3MThese expenses cover systems response, recovery and specialist support. M&S reported £100M in insurance proceeds separately, with sales and trading disruption discussed elsewhere in its results.
M&S · 2026.05.20 ↗The figures are presented by scope: the global market, a cross-company sample and one company’s accounts. Amounts retain their original currencies.
06 / OPEN METHODOLOGY
How the data was collected and prepared.
SOURCES AND DATA PREPARATION
Protico Labs’ sources
This feature uses official vulnerability data from the National Vulnerability Database (NVD), CISA and the CVE Program, alongside incident announcements from companies, researchers and public agencies. The source files, collection dates and calculations are listed below.
Monthly CVE | Official NVD API
Queries the NVD API by UTC publication date for each month, using noRejected to exclude rejected records and totalResults for the count. The original API responses are included in the data package.
API retrieval date · 2026-10-22
View source ↗CISA KEV | Official catalog
Counts additions by dateAdded in the official CSV, with one row per CVE ID. Dates follow the CISA catalog.
Latest addition · 2026-10-20
View source ↗Quarterly CVE | Official reference
Keeps the CVE Program metrics JSON’s original quarterly values as a separate reference, alongside monthly sums and the differences between them.
Published through in this snapshot · 2026-Q2
View source ↗Data collection and preparation
Download and preserve the source files
The monthly NVD API responses, October 1–21 queries for both years, CISA CSV and CVE Program quarterly JSON are retained with query windows, retrieval dates and SHA-256 hashes for checking downloaded copies.
Match the months and comparison days
The complete series covers 33 months, January 2024 through September 2026. A separate bar shows October 1–21, 2026. The headline year-over-year comparison uses October 1–21 in both 2025 and 2026, with 21 days on each side.
Check the statistics and incident records
A script checks monthly counts, running totals, matched-period comparisons, CSV and quarterly figures. Case notes follow the original announcements for discovery, disclosure and patch dates, including each source’s account of AI involvement.
What the numbers mean
- What is a CVE?
- A shared identifier and record for a publicly disclosed vulnerability. This chart counts new records by the UTC CVE publication date recorded in NVD, excluding rejected records.
- What is KEV?
- CISA’s Known Exploited Vulnerabilities Catalog records vulnerabilities with evidence of exploitation. This chart counts new entries by dateAdded, shown as a separate series alongside CVE publications.
- How is the monthly year-over-year comparison calculated?
- October 1–21, 2026 is compared with October 1–21, 2025. CVE counts are 12,543 versus 2,719, an increase of 361.3%. Change = (current / previous − 1) × 100%.
- How does the model comparison work?
- For announcement/access month m, keep that month separate. Let x[m] be the selected monthly count. Before = (x[m−3] + x[m−2] + x[m−1]) / 3; after = (x[m+1] + x[m+2] + x[m+3]) / 3. Change = (after / before − 1) × 100%. A change is shown when each side has three complete months.
- How is the curve drawn?
- Bars show monthly counts, with October displayed separately as a partial month through the 21st. The moving average uses complete months only: the current and previous two months, with available months used for the first two points. Model comparisons also use complete months only. Cumulative mode sums from January 2024 and adds the records collected so far for the October bar.
- What would further analysis involve?
- Model dates provide descriptive comparisons. Causal research needs comparison groups, collection methods and other developments over the same period. Global incident frequency needs a consistent scope. Spending uses IDC’s March 3, 2026 forecast; company costs retain their currencies and periods.
Definition sources: NVD ↗ · CVE Program ↗ · CISA ↗
Download the data and calculation script
To check the figures yourself, download and unzip the complete package, then run the Python 3 command below. It checks file hashes, monthly counts, running totals, monthly year-over-year and quarterly comparisons. The CSV contains 33 complete months plus one October progress row. It uses only the included files and works offline.
Complete data package · ZIP ↓- Chart data · JSON ↓
- Monthly counts and current-month progress · CSV ↓
- Research and cases · JSON ↓
- Sources and SHA-256 · JSON ↓
- Reproduction script · Python ↓
Original API responses and source snapshots
- nvd/2024-01.json ↓
- nvd/2024-02.json ↓
- nvd/2024-03.json ↓
- nvd/2024-04.json ↓
- nvd/2024-05.json ↓
- nvd/2024-06.json ↓
- nvd/2024-07.json ↓
- nvd/2024-08.json ↓
- nvd/2024-09.json ↓
- nvd/2024-10.json ↓
- nvd/2024-11.json ↓
- nvd/2024-12.json ↓
- nvd/2025-01.json ↓
- nvd/2025-02.json ↓
- nvd/2025-03.json ↓
- nvd/2025-04.json ↓
- nvd/2025-05.json ↓
- nvd/2025-06.json ↓
- nvd/2025-07.json ↓
- nvd/2025-08.json ↓
- nvd/2025-09.json ↓
- nvd/2025-10.json ↓
- nvd/2025-11.json ↓
- nvd/2025-12.json ↓
- nvd/2026-01.json ↓
- nvd/2026-02.json ↓
- nvd/2026-03.json ↓
- nvd/2026-04.json ↓
- nvd/2026-05.json ↓
- nvd/2026-06.json ↓
- nvd/2026-07.json ↓
- nvd/2026-08.json ↓
- nvd/2026-09.json ↓
- nvd/2025-10-01-21.json ↓
- nvd/2026-10-01-21.json ↓
- kev_official_raw.csv ↓
- cve_official_metrics_raw.json ↓
Run in that folder
python3 reproduce_counts.pyCite this research
Include the report title, retrieval date, metric/window and this page’s URL. Retain the source definitions when sharing a chart; cite the original statement when discussing a case.
Protico Community Intelligence, “PHP, Node.js and certificate security alerts. In the AI era, how much time do businesses have to respond?” (The Response Gap), retrieved 2026-10-22; monthly published CVE / CISA KEV, 2024-01 → 2026-09; 2026-10-01 → 2026-10-21.
Add a source or share a perspective
Have an incident to add or a figure worth checking? Share it in the lobby, with the relevant passage, month and source so other readers can follow along. Contributions are also welcome by email.
Or contribute by email ↗About the fonts on this page · The brand uses a locally hosted Inter font under the SIL Open Font License. Body text uses your device’s sans serif font; numbers and labels use monospace. If the animation is distracting, you can turn it off.
01 / Where the information comes from
Vulnerability counts come from public datasets; company cases come from the organizations’ own statements. CVE disclosures, KEV additions and individual incidents retain their own units and series.
02 / Which dates the charts use
The chart shows complete months and the current month through the 21st, with retrieval dates retained. October comparisons use the same 21 days in both years. Incident timelines separately record discovery, disclosure and patch dates.
03 / How model dates are added
Model dates come from official announcements and access records. Three-month averages on either side describe nearby changes; analysis of their causes also requires collection methods and other developments over the same period.
04 / How cases are selected
Cases have a public statement from the company or research team. The summaries cover affected systems, data and response actions, retaining distinctions between confirmed findings, possible exposure and ongoing investigation.
05 / How to read the amounts
Each amount keeps its year, currency and source, and is labeled as an estimate, forecast or company-disclosed impact. Market spending, study samples and company losses appear alongside their respective scopes.
06 / Records readers can contribute
Complete incident-reporting, notification-delivery and patch records can help document response timelines. Readers are welcome to share publicly citable records and sources in the discussion.
Official quarterly data cross-check
CVE.org and NVD-derived research use their respective record states, ingestion and snapshot dates. Both values and their difference are retained; official 2026Q3 awaits an update.
| Quarter | Sum of monthly research | Official CVE quarter | Difference |
|---|---|---|---|
| 2024-Q1 | 8,681 | 8,697 | -16 |
| 2024-Q2 | 11,698 | 11,716 | -18 |
| 2024-Q3 | 8,523 | 8,591 | -68 |
| 2024-Q4 | 11,051 | 11,073 | -22 |
| 2025-Q1 | 11,946 | 12,009 | -63 |
| 2025-Q2 | 11,695 | 11,701 | -6 |
| 2025-Q3 | 11,725 | 11,738 | -13 |
| 2025-Q4 | 12,785 | 12,796 | -11 |
| 2026-Q1 | 15,152 | 15,163 | -11 |
| 2026-Q2 | 20,688 | 20,709 | -21 |
Sources and dataset versions
- CVE publications · NIST NVD API · retrieved 2026-10-22
- CISA KEV · official 2026-10-21 snapshot
- CVE official quarterly reference · separate series
- PHP · official release archive
- Calif · discovery and disclosure timeline
- CERT-EU · advisory 2026-018
- OpenAI · AI-assisted PHP discovery
- Mozilla · eMudhra intermediate certificates
- Cloudflare · eMudhra incident response
- Node.js · October 21 security release
- Zeabur · October incident investigation
- 91APP · Commerce Cloud statement
- Railway · October 21 disclosure
- Sanae Takaichi · public statement
- EuRepoC · scope and incident data
- University of Maryland · Cyber Events Database and collection changes
- IDC · March 3, 2026 security spending forecast
- IBM / Ponemon · July 29, 2026 breach cost study
- Marks & Spencer · FY2026 results
- PwC · 2027 Digital Trust Insights · published October 1, 2026
- Railway · October 22 credential reset and service recovery guidance
07 / SERVICE POLICY & USER COMMUNICATION
Update your security budget—and your promises to users.
Security incidents affect the responsibilities and trust between businesses and their users. Protico examines how terms, privacy notices and internal processes address these changes. The five areas below draw on published guidance from NIST, CISA and other institutions.
- 01
Reconfirm the incident response plan with customers and users.
Review the standard response process with customers and users: what triggers it, who takes responsibility, how to get in touch and when updates will follow. Keep a contact route available during outages so people can follow the impact and response progress.
- 02
Make everyone's responsibilities clear.
Explain the company's security updates, account protections and data safeguards. Show users when to update devices, reset credentials or check suspicious logins, using examples they can follow.
- 03
Keep up with third-party security requirements and standards.
Regularly review the security requirements, data use, access permissions, incident notifications and support arrangements of third-party services and AI tools. When suppliers change features, terms or safeguards, assess the effect on current use and update internal rules and response procedures.
- 04
Make help easy to find.
Provide clear routes for account recovery, data access, correction or deletion requests, and complaints. Preserve users' legal rights when revising terms.
- 05
Walk through the process together.
Rehearse suspicious messages, compromised accounts and supplier alerts. Bring support, product, legal and security teams together, agree who takes over and fix the points where the process stalls.
Protico Community Intelligence organizes signals from community discussions into information businesses can follow, helping the responsible teams verify and respond while keeping service commitments connected to daily operations.
Sources on service policy and communication
- NIST SP 800-61 Rev. 3 — Incident Response Recommendations ↗
- NIST Cybersecurity Framework 2.0 ↗
- U.S. and International Partners Publish Secure-by-Design and -Default Principles and Approaches ↗
- NIST AI 600-1 — Generative Artificial Intelligence Profile ↗
- 台灣個人資料保護法：第 3、8、12 條及生效狀態 ↗
- Effective steps to cyber exercise creation ↗
FOR MEDIA, CREATORS & RESEARCHERS
Bring this research into your story.
You can quote, translate and adapt Protico’s original text, analysis and charts, including in commercial publications. Credit “Protico Community Intelligence”, link to the original and keep the reference date. Please label translations or other changes. No separate request is needed for uses within this scope.
What’s in the kit
Reference briefs in four languages, a source index, metric definitions, editable charts and a file manifest. Ready for reporting, presentations or further reading with research tools.
Download the media & Agent kit ↓
- Research snapshot
- 2026-10-22
- Complete months
- 2024-01 → 2026-09
Attribution you can use
Research and analysis: Protico Community Intelligence — PHP, Node.js and certificate security alerts. In the AI era, how much time do businesses have to respond? · Reference date: 2026-10-22 · https://labs.protico.io/enterprise-cybersecurity/php-nodejs-certificate-vulnerabilities/en/
Label any translation, excerpt or adaptation.
This permission covers Protico’s original work only. Third-party reports, datasets, social-post screenshots and logos remain subject to their own permissions or other lawful uses. The kit links to those sources; it does not grant their rights. Read the reuse terms ↗
POWERED BY COMMUNITY INTELLIGENCE
Community Intelligence.
More powerful than you think.
The experiences, questions and risk signals shared in communities can help businesses understand change. Protico Community Intelligence connects those conversations with public sources, helping teams identify relevant signals, assess what they mean and act earlier.