# PHP, Node.js and certificate security alerts. In the AI era, how much time do businesses have to respond?

Research and analysis: Protico Community Intelligence — PHP, Node.js and certificate security alerts. In the AI era, how much time do businesses have to respond? · Reference date: 2026-10-22 · https://labs.protico.io/enterprise-cybersecurity/php-nodejs-certificate-vulnerabilities/en/

This report brings together public vulnerability data, recent incidents and business costs to examine response time and how service promises, incident communication and user protections can keep pace.

## Research snapshot

- Complete months: 2024-01 → 2026-09 (33)
- Partial month: 2026-10-01 → 2026-10-21
- CVE snapshot: 2026-10-22T07:01:20.491Z
- KEV latest catalog entry: 2026-10-20
- Reference date: 2026-10-22

## Numbers to cite

| How the numbers were prepared | 2025-10-01 → 2025-10-21 | 2026-10-01 → 2026-10-21 | YoY |
| --- | ---: | ---: | ---: |
| CVEs published | 2,719 | 12,543 | +361.3% |

IDC’s March 2026 forecast puts worldwide security spending at USD 308 billion in 2026 and USD 430 billion in 2029. Both use the same March 2026 forecast edition. [IDC](https://www.idc.com/resource-center/press-releases/wwsecuritysg/)

M&S reported GBP 131.3 million in incident-related costs for its year ended March 2026, with insurance separately recorded. These costs cover systems response, recovery and external specialist support; the accounts discuss trading impacts separately. [M&S](https://corporate.marksandspencer.com/newsroom/press-releases/full-year-results-52-weeks-ended-28-march-2026)

## How the numbers were prepared

CVE uses publication month; KEV uses catalog addition month. Each series shows its own publication or catalog-update cadence.

- CVE uses official NVD API responses retrieved on 2026-10-22: publication dates use UTC, noRejected excludes rejected records, and totalResults supplies the counts. The research data package retains the original responses.
- KEV: CISA catalog grouped by dateAdded, showing when known-exploitation records entered the catalog.
- Official CVE quarterly metrics remain a separate reference series.

## Context to keep with the numbers

- The monthly year-over-year comparison uses October 1–21 in both 2025 and 2026, with 21 days on each side. The chart retains 33 complete months and shows October 2026 progress through the 21st separately.
- AI model dates provide context. Assessing AI’s role in the increase requires record-level information about research tools, discoverers and other factors.
- Global spending forecasts, study averages and company accounts retain their own currencies, periods and measurement scopes.

## From Taiwan to the world: shared risks across business services.

91APP reported an attack on its commerce database. Zeabur described an incident across deployment regions, while Railway disclosed possible access to environment variables. Together, the cases connect familiar business services in Taiwan with the cloud infrastructure and credentials that support them.

### 91APP · OCT 16 · 2026

91APP reported automated attacks on its Commerce Cloud database and access to some information.

The company began an external investigation and emailed affected customers with assistance. [91APP](https://91app.com/blog/91app-202610-security/)

### Zeabur · OCT 14–15 · 2026

Zeabur confirmed access to environment variables and account data, identifying incomplete internal credential rotation.

The incident spanned deployment regions and included credentials and API keys for upstream services. [Zeabur](https://zeabur.com/blogs/october-2026-security-incident)

### Railway · OCT 21–22 · 2026

Railway said an unauthorized party may have obtained some decrypted environment variables.

October 22 update: Railway reset bucket credentials. Users must redeploy bucket services, reconnect GitHub and revoke the registry tokens removed from Railway through GitHub itself. [Railway](https://blog.railway.com/p/security-disclosure-wednesday-october-21st)

On the evening of October 21, Japan’s Prime Minister Sanae Takaichi posted on X asking people to check whether they used PHP and prepare to update it. A software update normally handled by engineering teams had drawn a personal reminder from the prime minister. [X](https://x.com/takaichi_sanae/status/2112890642590564386)

## Protico’s view

Security incidents affect the responsibilities and trust between businesses and their users. Protico examines how terms, privacy notices and internal processes address these changes. The five areas below draw on published guidance from NIST, CISA and other institutions.

### Reconfirm the incident response plan with customers and users.

Review the standard response process with customers and users: what triggers it, who takes responsibility, how to get in touch and when updates will follow. Keep a contact route available during outages so people can follow the impact and response progress.

### Make everyone's responsibilities clear.

Explain the company's security updates, account protections and data safeguards. Show users when to update devices, reset credentials or check suspicious logins, using examples they can follow.

### Keep up with third-party security requirements and standards.

Regularly review the security requirements, data use, access permissions, incident notifications and support arrangements of third-party services and AI tools. When suppliers change features, terms or safeguards, assess the effect on current use and update internal rules and response procedures.

### Make help easy to find.

Provide clear routes for account recovery, data access, correction or deletion requests, and complaints. Preserve users' legal rights when revising terms.

### Walk through the process together.

Rehearse suspicious messages, compromised accounts and supplier alerts. Bring support, product, legal and security teams together, agree who takes over and fix the points where the process stalls.

Protico Community Intelligence organizes signals from community discussions into information businesses can follow, helping the responsible teams verify and respond while keeping service commitments connected to daily operations.

## Reuse permission

You can quote, translate and adapt Protico’s original text, analysis and charts, including in commercial publications. Credit “Protico Community Intelligence”, link to the original and keep the reference date. Please label translations or other changes. No separate request is needed for uses within this scope.

This permission covers Protico’s original work only. Third-party reports, datasets, social-post screenshots and logos remain subject to their own permissions or other lawful uses. The kit links to those sources; it does not grant their rights.

Label any translation, excerpt or adaptation.

[Read the reuse terms](https://labs.protico.io/enterprise-cybersecurity/php-nodejs-certificate-vulnerabilities/media-kit/license.txt)

## Sources and further reading

- [Download structured JSON](https://labs.protico.io/enterprise-cybersecurity/php-nodejs-certificate-vulnerabilities/media-kit/reference.json)
- [Download the editable SVG chart](https://labs.protico.io/enterprise-cybersecurity/php-nodejs-certificate-vulnerabilities/media-kit/chart-en.svg)
- [Research data kit](https://labs.protico.io/enterprise-cybersecurity/php-nodejs-certificate-vulnerabilities/response-gap-data.zip)
- [Original research and source notes](https://labs.protico.io/enterprise-cybersecurity/php-nodejs-certificate-vulnerabilities/research.json)
- [Original source manifest](https://labs.protico.io/enterprise-cybersecurity/php-nodejs-certificate-vulnerabilities/source-manifest.json)

- NIST National Vulnerability Database — [monthly-cve](https://nvd.nist.gov/developers/vulnerabilities)
- CISA — [kev](https://github.com/cisagov/kev-data/blob/fd12990e9c566a1ad3060e1a2073129778f438cc/known_exploited_vulnerabilities.csv)
- CVE Program — [official-quarterly-cve](https://github.com/CVEProject/cve-website/blob/f2b4f05012bbbe22905587c6d0c48e23767b1822/src/assets/data/metrics.json)
- IDC — [Global Security Spend to Exceed $300 Billion in 2026 as the Adoption of AI-Driven Security Platforms Gains Momentum](https://www.idc.com/resource-center/press-releases/wwsecuritysg/) · 2026-03-03
- IDC — [IDC IT Security Summit, 2027 Series](https://www.idc.com/mea/events/become-a-sponsor/it-security/)
- Gartner — [Forecast Analysis: Information Security, Worldwide, 2026](https://www.gartner.com/en/documents/7408930) · 2026-02-05
- Gartner — [Forecast: Information Security, Worldwide, 2024-2030, 3Q26](https://www.gartner.com/en/documents/8422113) · 2026-09-24
- Gartner — [Gartner Forecasts the Market for Securing AI Will Reach $4.8 Billion in 2027](https://www.gartner.com/en/newsroom/press-releases/2026-08-26-gartner-forecasts-the-market-for-securing-ai-will-reach-almost-5-billion-in-2027) · 2026-08-26
- IBM / Ponemon Institute — [IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average](https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average) · 2026-07-29
- IBM — [IBM Report: UK Sees Drop in Breach Costs as AI Speeds Detection](https://uk.newsroom.ibm.com/2025-cost-of-data-breach-UK) · 2025-07-30
- Marks & Spencer Group plc — [Full Year Results for the 52 Weeks Ended 28 March 2026](https://corporate.marksandspencer.com/newsroom/press-releases/full-year-results-52-weeks-ended-28-march-2026) · 2026-05-20
- JLR — [JLR Q3 Performance Impacted by Previously Indicated Challenges](https://www.jlr.com/news/2026/02/jlr-q3-performance-impacted-previously-indicated-challenges) · 2026-02-05
- JLR — [Annual Report 2026](https://www.jlr.com/annual-report-2026)
- FBI Internet Crime Complaint Center — [2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) · 2026-04
- PwC — [2027 Global Digital Trust Insights: C-suite playbook and findings](https://www.pwc.com/us/en/services/consulting/cybersecurity-data-tech-risk/library/global-digital-trust-insights.html) · 2026-10-01
- [PHP / PHP2Shell](https://www.php.net/archive/2026.php)
- [PHP / PHP2Shell](https://calif.io/php2shell/)
- [PHP / PHP2Shell](https://cert.europa.eu/publications/security-advisories/2026-018/)
- [PHP / PHP2Shell](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/)
- [PHP / PHP2Shell](https://www.wiz.io/blog/php2shell-php-rce)
- [eMudhra intermediate certificates](https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/)
- [eMudhra intermediate certificates](https://blog.cloudflare.com/emudhra-certificate-compromise/)
- [Node.js October security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)
- [Zeabur October incident](https://zeabur.com/blogs/october-2026-security-incident)
- [Zeabur October incident](https://zeabur.com/blogs/august-2026-security-incident)
- [Zeabur October incident](https://status.zeabur.com/)
- [91APP Commerce Cloud](https://91app.com/blog/91app-202610-security/)
- [Railway environment variables](https://blog.railway.com/p/security-disclosure-wednesday-october-21st)
- [Railway environment variables](https://blog.railway.com/p/security-disclosure-recommendation-redeploy-buckets-and-reconnect-github-after-the-credential-reset)
- [Japan prime minister PHP warning](https://x.com/takaichi_sanae/status/2112890642590564386)
- NIST — [NIST SP 800-61 Rev. 3 — Incident Response Recommendations](https://csrc.nist.gov/pubs/sp/800/61/r3/final) · 2025-04-03
- NIST — [NIST Cybersecurity Framework 2.0](https://doi.org/10.6028/NIST.CSWP.29) · 2024-02-26
- CISA — [U.S. and International Partners Publish Secure-by-Design and -Default Principles and Approaches](https://content.govdelivery.com/accounts/USDHSCISA/bulletins/354a744) · 2023-04-13
- NIST — [NIST AI 600-1 — Generative Artificial Intelligence Profile](https://doi.org/10.6028/NIST.AI.600-1) · 2024-07
- 全國法規資料庫 — [台灣個人資料保護法：第 3、8、12 條及生效狀態](https://law.moj.gov.tw/LawClass/LawOldVer.aspx?pcode=I0050021) · 2023-05-31
- UK National Cyber Security Centre — [Effective steps to cyber exercise creation](https://www.ncsc.gov.uk/guidance/effective-steps-to-cyber-exercise-creation)