Tunisian expert warns of 50 billion exposed passwords
By the AFREEQUE newsroom, based on Lapresse
Ryan Dahl · MITTunisian cybersecurity expert Oussama Lassissi warned of vulnerabilities affecting PHP and Node.js that could allow hackers to take control of websites. He estimated that 50 billion passwords would be circulating on the dark web by the end of October 2026 and recommended regular updates, according to remarks he made on a radio programme.
Vulnerabilities discovered in PHP and Node.js in October could allow hackers to take control of targeted websites, Tunisian cybersecurity expert Oussama Lassissi warned on Monday 26 October during a radio programme. He said that around 50 billion passwords would be circulating on the dark web by the end of the month, compared with 32 billion a year earlier.
PHP, a language used by more than 70% of websites worldwide, is notably affected by these vulnerabilities, according to Oussama Lassissi. Fixing them may require websites to be updated or even temporarily disabled. The expert added that artificial intelligence tools had helped detect the vulnerabilities.
In Tunisia, around 12 million passwords associated with users were reportedly recorded in 2025, he said. He recommended that individuals and businesses regularly update their devices and websites, install antivirus software, check the origin of emails and avoid saving their passwords in browsers. Corporate websites, e-commerce and small and medium-sized businesses are among the exposed targets.
Lassissi praised the swift intervention of Tunisia’s National Cybersecurity Agency and offered to help businesses secure their infrastructure. PHP vulnerabilities had already led some websites to close temporarily, according to an article on the language’s vulnerabilities.
