News · Security · November 12, 2026

Breach Briefing: AI turned a PHP bug into a global rush

In October 2026 AI-assisted researchers found critical PHP flaws, and exploits followed within days. What happened, and what it means for your files.

DRIVE 369 DAO · 3 min read

Also in: Русский · 中文

This is a Breach Briefing: one real incident, what is publicly known, and what a person or a small team can take from it.

What happened

In October 2026, two critical flaws in PHP, a language used by nearly 70% of websites by some estimates, were patched worldwide. They are tracked as CVE-2026-109618 and CVE-2026-109619. CNBC reports that researchers at Wiz and Calif found them using advanced AI models, and the episode was nicknamed "Black October". Industrial Cyber reports that CISA said every PHP setup serving web requests was exposed, including PHP-FPM, Apache with mod_php and LiteSpeed, and advised taking systems that cannot be patched offline. Reports say CISA added both flaws to its Known Exploited Vulnerabilities list on October 26, and that Cloudflare saw millions of exploit attempts in the days after disclosure (CyberGuy). Some outlets note that many old PHP versions are still running (CNN).

Why it matters beyond PHP

The lesson is speed. Former CISA director Chris Krebs told CNBC that about 3% of all critical vulnerabilities ever discovered were found in the last month, and Anthropic's deputy CISO Jason Clinton said defenders may need to hold on for roughly 18 months. When AI finds bugs faster than people patch them, the gap between a disclosure and an attack shrinks from weeks to days. Large companies can use the same models to harden their systems. Small businesses often cannot.

What it means for your data

You cannot out-patch every server you depend on. So the question to ask is: if the server holding my data is compromised tomorrow, what does the attacker get?

• If the provider holds the key, a server compromise can mean readable files.
• If your device holds the key, the same compromise gets sealed blocks.

In Ghostdrive, files, notes and AI memory are encrypted on your device with a key only you hold. Nodes, relays and gateways keep ciphertext and cannot read it. Ghostdrive's own website is a static build, and its nodes run TypeScript, not PHP. That does not make it immune: it has different bugs, and the same speed applies to us, which is why we run our own scans and publish the results (what our scan found).

Use case: an agency with a client site

A small agency runs a client's WordPress site, and the contracts and brand files sit on the same server. If that server is hit, everything on it is read. The safer shape: keep the files in a sealed Drive, share a single file with a link that expires, and let the website show only what is meant to be public. Then a web-server bug exposes a website, not a client archive.

Do this week

1. Patch PHP and every web component, or take the legacy site offline, as CISA advised.
2. Turn on two-factor authentication and use a password manager. Pass is one.
3. Move private files off servers that also run public software.
4. Write down who you would call if your host announced a breach tomorrow.

Where Ghostdrive stands: the vault, Drive and Pass are live. The storage market and the DAO run on a testnet with an audit pending.

Update, November 12: three weeks on, what is proven and what is not, with the evidence tier by tier.

Academy: start here · Drive · Security and audits