Home Blog The Internet Is Not Safe, and It Won't Get Safer on Its Own

The Internet Is Not Safe, and It Won't Get Safer on Its Own

By Phi lac N - Team Member Phi Lac N.
Published an hour ago
~6 minute read
wave small
Larger text Mail Print

In the span of three weeks this fall, two of the most widely used web technologies shipped emergency security fixes, a crypto exchange lost billions of dollars in about twenty minutes, and banks on two continents reported customer data exposed.

On October 21, PHP patched two critical flaws that let attackers run code on a web server without a password. On November 11, Node.js followed with fixes for 16 vulnerabilities. In between, Binance reported the largest crypto theft on record, and banks in India and South Korea began investigating leaked customer records.

If those headlines feel routine, that is exactly the problem. Serious security incidents are no longer rare events. They are the background noise of running anything online, and the organizations that stay safe are the ones that plan for them before they happen.

1. The software under everything keeps breaking

Most people never think about PHP or Node.js, but a large share of the websites, shops, portals and APIs they use every day run on one of them.

PHP, October 2026: two flaws nicknamed "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619) were rated critical, 9.2 out of 10. A request that ends badly could leave PHP's memory in a corrupted state, and an attacker could turn that into running their own code on the server. No password needed. Fixed versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Some organizations took websites offline until they could patch.

Node.js, November 2026: 16 vulnerabilities, clustered in HTTP/2 and TLS, the code that handles encrypted web traffic. Several can be triggered remotely by anyone, for example to crash a server or leak pieces of its memory. Fixed versions: 22.23.5, 24.22.3 and 26.13.1.

And here is the part that hurts: Node.js 20 and older get no fix at all. They are "end-of-life". If an application still runs on an old version, there is no patch to install. The only way out is an upgrade, and upgrades take testing, time and budget.

2. The biggest names get hit too

If you think this only happens to small companies with no security team, look at the news.

Binance, October 29, 2026: the exchange reported a security incident affecting about 6.3 billion US dollars in assets, widely described as the largest crypto theft on record. Blockchain analysts at TRM Labs say most of the money left across ten blockchains in roughly twenty minutes, and attribute the attack to North Korea-linked hackers. Binance's first explanation pointed to a compromised engineer's laptop; it later said the attack was more complex than that. Binance paused withdrawals and says it is covering the losses itself. A company with one of the largest security budgets in the industry still got hit.

Banks, October 2026: India's largest bank, State Bank of India, opened an investigation after a suspected cyberattack exposed several thousand customer records. In South Korea, reports describe an attack that touched 16 financial institutions, including major banks, with names, contact details and national ID numbers leaked. In November, South Korea's own financial security institute reported a breach involving data about bank staff.

Banks and exchanges spend more on security than almost anyone. They still lose.

3. Why cybersecurity is so hard

Defenders have to be right every time. Attackers only have to be right once. Everything else follows from that.

  • The attack surface is enormous. A typical company runs websites, cloud apps, laptops, phones, email, file shares, third-party tools and old projects nobody remembers. Every one of them is a door.
  • Attackers are faster than ever. When a patch is published, attackers compare it with the old version to find the hole, sometimes within hours. AI tools are making both the discovery and the exploitation of bugs faster.
  • Old software never really dies. The website built five years ago still runs on the server it was built on. The language version it uses went end-of-life two years ago. Nobody owns it, so nobody upgrades it.
  • People are the easiest target. A convincing email, a fake login page or a stolen laptop is often easier than breaking encryption. Many of the largest incidents start with one person's account.
  • Secrets leak quietly. API keys and passwords end up committed to code repositories, pasted into chats or saved in shared folders. Once a key leaks, deleting the file is not enough; the key has to be replaced.
  • Patching itself carries risk. A rushed update can take a service offline. Teams are stuck between "patch now and risk an outage" and "wait and risk a breach".

4. What you can actually do

You cannot make the internet safe. You can make yourself a much harder target than the next company.

  1. Know what you run. Keep a list of every application, server and website, and which language version each one uses. You cannot patch what you do not know exists.
  2. Patch fast, but in the right order. Anything that faces the internet and runs code on a server comes first. A static website built with Node.js is far less exposed than a server running on Node.js.
  3. Retire end-of-life software. Plan upgrades before a version goes out of support, not after the next emergency. Budget for it every year.
  4. Turn on multi-factor authentication everywhere. Email, cloud consoles, code repositories, admin panels. It stops a huge share of account takeovers.
  5. Get secrets out of code. Store passwords and API keys in a proper secrets manager. If a key was ever committed or shared, rotate it.
  6. Watch for alerts. Subscribe to security announcements for the software you depend on, so you hear about the next PHP or Node.js release the day it ships, not two days later.
  7. Test your backups. A backup you have never restored is a hope, not a plan.
  8. Plan your updates. Patch in a test environment first, deploy at a quiet time, and know how to roll back. An outage caused by a rushed patch is still an outage.

5. Safety is a habit, not a product

There is no tool you can buy that makes this go away. The companies that come through these weeks in good shape are not the ones with the most expensive software. They are the ones that know what they run, patch quickly, retire old systems on schedule, and treat security as routine work instead of an emergency.

The internet is not safe. It was never designed to be. But "not safe" does not have to mean "not prepared".

Not sure where you stand?

If you are not sure which of your systems were affected by this autumn's PHP and Node.js releases, now is a good time to find out. NIFTIT helps organizations review their Microsoft 365 and Azure environments, tighten identity and access controls, and build a practical plan for patching and retiring outdated systems. Talk to our team to see where your organization stands.

Sources

PHP security release, October 2026

Node.js security release, November 2026

Binance incident, October 2026

Bank incidents, October-November 2026

Here at NIFTIT, from Office 365 consulting to SharePoint solutions, we can handle projects of any size and difficulty. We follow industry standards and best practices to build world-class solutions. Learn more about our services here!
Previous How to Give Every Employee an HR Assistant Without Buying Copilot for Everyone
Next Create a Custom Theme in SharePoint Online