In October several important security alerts came out within a few days. In one of them, the PHP one, AI tools played a big part in finding the flaw. More and more vulnerabilities are being found and they are published faster, and if you have a digital product in production (a management platform, an online shop or an app), that leaves less room for falling behind on updates. We look at it through the PHP case and the eMudhra certificates, both from the last few weeks.
What happened with PHP in October
On 21 October the PHP team released an urgent fix for two critical flaws, known as PHP2Shell, which in the worst case let someone take control of a server without a password. The problem was in the PHP engine itself, so it affected any project built with it. The details leaked a day before the patch came out, and some public bodies took services offline while they updated.
One of the two flaws had been known since 2024, but its severity only became clear this summer, when several AI-assisted reviews, by OpenAI and by security firms such as Wiz and Trail of Bits, reached it separately.
The eMudhra certificates and the apps that had to be republished
That same week it emerged that the keys for eight intermediate certificates from eMudhra, a certificate authority, had been compromised. These certificates confirm that a connection is reaching the right server, and with the keys in the wrong hands someone could pose as a legitimate service. Browsers and operating systems stopped trusting them within days, and eMudhra has announced it is leaving this business.
On phones and computers, the usual system update was enough. Some apps, however, carry their own list of certificates and don't pick up those changes. For them, the affected tools released fixed versions, and the app had to be rebuilt and uploaded to the stores again to reach users.
Why more security flaws are being found now
According to OpenAI, the PHP case is one of several similar findings it has in progress, and it expects many more in the coming months. In October Microsoft fixed more than 1,400 vulnerabilities, the highest figure it has published in a single month. AI tools review code much faster and are bringing to light flaws that had been there for years.
Finding old flaws means they can be fixed, although anyone looking for flaws to exploit has the same tools, and the time between a vulnerability being published and someone trying to use it keeps getting shorter. With PHP2Shell, the attempts started as soon as the details leaked.
Why staying up to date matters more now
When an alert comes out, the first step is knowing whether it affects you. If someone keeps track of which PHP version each server runs, which libraries the project uses or which Flutter version built the app that is in the stores, that is quick to answer. Then the fix has to be applied, tested in a staging environment and moved to production. With an app you also have App Store and Google Play review, and getting people to update, which an in-app notice or a minimum version can help with.
Where the difference really shows is in how up to date the project was before the alert. PHP released fixes for versions 8.2 to 8.5, so anyone still on an earlier version had no patch to install and first needed a migration to a supported version. Something similar happens with an app that hasn't been built for months, because the changes that have piled up need sorting out before the fix can be published. Updating little by little through the year is what lets you respond in time when the next alert arrives.
If you want to check where your project stands
<p>If you have a project up and running and aren't sure what state its versions are in, now is a good time to check, without waiting for the next alert. We can go through it with you and tell you what is up to date, what should be updated soon and what can wait. And if you'd rather not have to keep an eye on all this, it's part of what our maintenance and evolution service covers.
