Cybersecurity leaders are warning that artificial intelligence may sharply accelerate the discovery and exploitation of software vulnerabilities, following the disclosure of a severe flaw affecting PHP, a programming language used across millions of websites.
The concern is not simply that AI can write code. Security researchers and executives say systems with the capacity to search patiently through vast amounts of software could identify fundamental weaknesses faster than defenders can investigate, prioritize, patch, and deploy fixes. The episode has been described by some in the security industry as part of “Black October,” a period that has intensified warnings about an AI-enabled surge in vulnerabilities.
Why the PHP flaw drew attention
PHP is widely used on the web, so serious vulnerabilities in the language can carry implications far beyond a single company or product. The reported flaw raised the prospect that a weakness could have left a large number of sites exposed for years before it was identified and addressed.
The scale of exposure is difficult to determine from broad estimates alone, and the article notes that some experts estimated that 70% of websites could have been at risk. That figure should be read as an assessment cited by experts, rather than as a definitive measurement of compromised sites. The central point is clearer: a flaw in a deeply embedded technology can create systemic risk because of its enormous installed base.
Researchers reportedly used AI to help identify critical flaws in PHP. That development has become a focal point for a wider question facing software developers, operators, and security teams: what happens when the cost of finding defects falls more quickly than the cost of repairing them?
A faster search for old weaknesses
Software vulnerabilities are not new. The internet has always depended on the work of defenders, independent researchers, maintainers, and vendors who discover bugs and release patches. What has changed is the possibility that AI tools can make that search more persistent, more automated, and more accessible.
Cloudflare chief executive Matthew Prince said AI is uniquely able to identify flaws at a pace that could feel catastrophic because the security community may not be able to respond fast enough. He warned that the next two years could be especially difficult as tools with what he described as “infinite patience” examine the internet for vulnerabilities.
The phrase captures a practical difference. Human researchers must select targets and devote limited attention to each one. Automated systems can potentially scan many codebases, configurations, and patterns simultaneously. If they reliably surface credible leads, attackers and defenders alike could have a much larger queue of issues to examine.
The defender’s bottleneck is patching
Finding a vulnerability is only the first stage of security work. A reported flaw has to be confirmed, understood, assigned a severity, fixed without breaking other functions, tested, distributed, and installed. Organizations must also identify every affected system, including older or poorly documented deployments.
That response chain is why industry figures are focused on a potential mismatch between discovery and remediation. Jason Clinton, Anthropic’s deputy chief information security officer, warned of a possible “vulnerability tsunami,” arguing that there may not be enough time to patch critical infrastructure if AI-assisted discovery produces major flaws at high volume.
Sam Altman likewise said he no longer believed all bugs could be patched, according to the report. The statement does not mean software maintenance is futile. It points instead to a harder operating environment: security teams may have to make more rapid, risk-based choices about which weaknesses demand immediate action and which can be managed through other controls while fixes are developed.
AI changes both sides of the equation
AI’s security effects are not limited to attackers. The same tools can support code review, vulnerability triage, testing, and the search for affected systems. The report notes that cybersecurity experts have warned for months about a “vulnpocalypse,” a shorthand for AI making it easier to identify security bugs.
The PHP episode has sharpened the concern because it involved a programming language with broad internet use and because researchers used AI in the discovery process. It is a reminder that the impact of AI in cybersecurity may be felt through ordinary, foundational technology rather than only through highly visible attacks.
For organizations, the immediate lesson is operational. Asset inventories, patch-management processes, clear ownership of internet-facing systems, and the ability to deploy urgent updates remain essential. AI may alter how quickly risks emerge, but the effectiveness of response still depends on knowing what systems exist and being able to act on credible security information.
From warning to preparation
Predictions of an AI-driven security crisis should not be mistaken for proof that every website or system is already compromised. The report describes warnings from executives and researchers about a likely rise in discovery and exploitation, not a complete accounting of attacks.
Still, the direction of travel is significant. A vulnerability in a widely used language can reveal how much of the internet depends on software components that many users never see. If AI makes flaws in those components easier to find, the burden on maintainers and operators could grow quickly.
The most important question may be whether defensive practices can scale at the same pace. The PHP vulnerability has become a high-profile test case for that question: an example of how AI-assisted research can expose latent risk, and why the work of patching and maintaining the internet’s underlying software may become even more urgent.
This article is based on reporting by The Guardian. Read the original article.
Originally published on theguardian.com
