AI-Found PHP Flaws Prompt Urgent Patches and Warnings About Wider Internet Risk
Cybersecurity leaders have warned that AI tools will expose more fundamental weaknesses in the internet's underlying infrastructure in the months ahead. The warnings follow the disclosure of critical flaws in PHP, a programming language used across millions of websites.
PHP released a patch on 21 October fixing several memory-safety vulnerabilities in its core engine. Memory-safety flaws are bugs in how software manages a computer's memory. The two most serious, identified as CVE-2026-109618 and CVE-2026-109619, are rated Critical, and PHP's own site says they can allow unauthenticated remote code execution, meaning an attacker could run commands on a server without logging in. PHP scheduled the release for 14:00 UTC that day.
Two cybersecurity companies independently reported that the flaw was discovered using artificial intelligence. PHP's developers said the critical flaw was found in 2024. Reuters reported that PHP underlies roughly 70% of all websites, and some experts estimated that 70% of sites on the internet were at risk from the PHP vulnerabilities.
Government and private websites in the US and UK temporarily took their sites offline to apply the fixes. The US National Security Agency issued an alert recommending that any site running PHP install the patches immediately. It warned that malicious actors may exploit the bugs to reach servers without authorisation, steal sensitive data, disrupt services or move deeper into a network.
Matthew Prince, chief executive of Cloudflare, a web infrastructure company, said his firm saw evidence of thousands of people trying to exploit the flaws in the 10 hours before they were announced. Reuters, citing Cloudflare, reported that millions of hacking attempts followed the disclosure. Prince said AI can find security flaws at a pace that could feel catastrophic, because the security community may not be able to move quickly enough to address them.
Researchers' use of AI to help find the flaws has led some commentators to call the period "Black October," a term the Guardian used to describe researchers using AI to identify critical flaws in a coding language that may have gone unpatched for years.
Industry leaders have offered stark assessments. On Thursday evening, Sam Altman, chief executive of OpenAI, said, "I no longer think we're going to be able to patch all bugs." Jason Clinton, deputy chief information security officer at Anthropic, predicted a "vulnerability tsunami" in a post on X, writing, "There won't be enough time to patch critical infrastructure." Marc Benioff, chief executive of Salesforce, called the situation a "code red."
Tech executives have warned that AI will be used both to find and to exploit security vulnerabilities at an unprecedented scale and pace. OpenAI has published a page on coordinated disclosure, the process of reporting flaws to their makers before they become public, under the title "Patch the Planet."
