AI-assisted research finds critical PHP flaws as exploit attempts surge

On Oct. 21, 2026, researchers announced they had used AI to identify critical flaws in PHP, dubbing the disclosure Black October. The server-side scripting language powers millions of websites, and the flaws may have left them vulnerable to hackers for years. Some experts estimated that 70 percent of all internet sites faced hacking risk due to the PHP flaws. Before Black October, researchers had not used AI to find a weakness as fundamental and critical as the PHP flaws.

Wiz researchers said the underlying PHP flaws existed for decades, but proving exploitability required a complex chain at the edge of human capability. The researchers at AI security platform Wiz described the flaws as among the most severe in PHP and arguably in software history. Cybersecurity experts had warned for months about a vulnpocalypse, or AI making security bugs easier to identify.

Cloudflare detected thousands of people attempting to exploit the PHP flaws during the 10 hours before the announcement. Cloudflare chief executive Matthew Prince said attempts rose to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions thereafter.

Government and private websites across the US and UK temporarily took down their sites to patch the bugs after the announcement. The US National Security Agency issued an alert recommending that any site running PHP implement patches immediately. The agency warned that cyber actors may exploit the bugs to access servers without authorization, letting attackers take data, interrupt service or penetrate deeper into a network.

Speaking on Thursday evening, Sam Altman said he does not believe every bug can be patched. “I no longer think we’re going to be able to patch all bugs,” Altman said.

Jason Clinton, Anthropic’s deputy chief information security officer, predicted a vulnerability tsunami and said critical infrastructure cannot be patched in time. Salesforce chief executive Marc Benioff agreed with Clinton and described the situation as a code red.

Altman joined the chorus of executives warning about AI and patching. Matthew Prince said AI can find security flaws at a catastrophic pace because defenders cannot respond quickly enough. Prince said AI is uniquely able to find flaws at a pace that will feel catastrophic.

Prince predicted the next two years will be difficult because automated tools can search the internet for vulnerabilities without tiring. Technology leaders warned that malicious actors will use AI to exploit vulnerabilities at a rapid pace. Executives expect artificial intelligence to reveal critical weaknesses in worldwide internet systems over the coming months.

The author of a post titled Black October said AI-driven cyber attacks across sectors show AI risks are no longer a future concern. The author said several dozen cyber attacks took place over the past two days and affected government, education, technology and banking.

The author estimated the best open-source AI models were 90-95 percent as capable as the most advanced systems. The author claimed hackers were using some models developed in China to target organizations in Western countries.

Frontier AI models can write code, solve complex problems, work 24/7 and be deployed in groups of 10,000 with one command, according to the author. The author said current AI advancement represents a fast takeoff scenario.

The author’s advice for basic account and device protections included turning on multifactor authentication, storing login credentials in a password manager, looking into an identity protection service, and putting smart devices on a separate network. These measures were described as basic protections for online accounts and devices.