Cybersecurity experts and technology executives are raising the alarm over a new era of artificial intelligence-powered hacking following the discovery of a severe vulnerability in the PHP programming language. Industry leaders warn that AI could expose fundamental weaknesses across the internet at a speed that security teams may struggle to match.
Sam Altman, OpenAI’s CEO, expressed concern about the growing challenge of fixing software vulnerabilities, suggesting that developers may eventually struggle to patch every bug as AI becomes more capable of identifying security flaws.
The warnings have intensified during what researchers and industry observers have called “Black October,” a period marked by the discovery of critical software weaknesses with the assistance of AI tools. The PHP programming language, which powers millions of websites, was found to contain serious flaws that may have existed for years.
Jason Clinton, Anthropic’s deputy chief information security officer, warned that the months ahead could bring a “vulnerability tsunami,” raising concerns that organizations may not have enough time to address critical weaknesses in their systems. Salesforce CEO Marc Benioff also described the situation as a “code red.”
Cloudflare CEO Matthew Prince echoed these concerns, arguing that AI can identify software vulnerabilities at a speed and scale that could overwhelm the cybersecurity industry.
Prince warned that the next two years could be particularly challenging as AI systems become increasingly capable of searching the internet for weaknesses. These tools could make it significantly easier for researchers to uncover flaws, but they could also give cybercriminals new opportunities to exploit them.
Serious PHP Vulnerabilities Raise Global Security Concerns
Although cybersecurity professionals have warned for months about the possibility of an AI-driven surge in software vulnerabilities, the discovery of critical PHP flaws has intensified those concerns.
PHP is widely used to build and operate websites and web applications. Researchers reported vulnerabilities that could expose affected systems to attacks, with some estimates suggesting that a substantial portion of websites could be at risk. The actual exposure depends on the affected software versions, configurations and whether the relevant vulnerabilities can be exploited in a particular environment.
The situation highlights a growing cybersecurity challenge: AI can help defenders discover and fix vulnerabilities, but the same capabilities may also help malicious actors identify weaknesses and develop attacks more quickly.
Reports of exploitation attempts emerged after the PHP vulnerabilities were disclosed. Some government and private-sector websites in the United States and the United Kingdom reportedly took their services offline temporarily while applying security updates.
The US National Security Agency (NSA) also issued a warning urging organizations running affected PHP software to apply the relevant patches promptly. The agency cautioned that attackers could exploit the weaknesses to gain unauthorized access to servers.
Such intrusions could allow criminals to steal sensitive information, disrupt services or move deeper into compromised networks.
Exploitation Attempts Surge After Disclosure
Cloudflare, a cybersecurity and internet infrastructure provider, reported a sharp increase in attempts to exploit the PHP vulnerabilities following their disclosure.
In a post on X, Prince described a rapid escalation in suspicious activity, reporting thousands of attempts before the announcement, followed by tens of thousands within 45 minutes, hundreds of thousands within two hours and millions by the time of his update.
The reported surge illustrates how quickly attackers may react when critical vulnerabilities become public knowledge. It also highlights the pressure facing organizations responsible for protecting internet-facing systems.
Researchers at Wiz, an AI security platform, described the vulnerabilities in a blog post as among the most severe discovered in PHP, emphasizing the complexity involved in demonstrating how the flaws could be exploited.
According to the researchers, the underlying weaknesses had existed for decades, but establishing their exploitability required a sophisticated sequence of steps that would have been difficult for human researchers to execute in practice.
AI Could Transform Both Cybersecurity and Cybercrime
The events surrounding “Black October” demonstrate the growing dual-use nature of artificial intelligence in cybersecurity. AI tools can help security researchers discover long-standing weaknesses, accelerate software testing and strengthen defenses. However, attackers may also use similar capabilities to automate vulnerability discovery and exploit unpatched systems.
This creates a difficult race between organizations trying to secure their infrastructure and malicious actors seeking to take advantage of newly discovered flaws.
Businesses, website owners and technology providers may need to prioritize faster security updates, continuous vulnerability monitoring, regular software audits and stronger access controls.
As AI-driven security tools continue to advance, the challenge will not simply be finding vulnerabilities. It will also be ensuring that critical weaknesses are fixed before attackers can exploit them.
The warnings from technology executives underline a growing concern across the industry: the speed of AI-assisted hacking could outpace traditional security practices, making rapid detection, coordinated disclosure and timely patching increasingly important.
Source: theguardian Edited by Bernie
