"Black October": experts warn of AI hacking wave after PHP flaw

Cybersecurity leaders are warning of a "vulnerability tsunami", as artificial intelligence tools uncover fundamental weaknesses in the internet's infrastructure faster than they can be fixed.

The warnings follow the discovery this week of a severe flaw in PHP, the programming language behind millions of websites, which researchers found with the help of AI and which may have gone unpatched for years. The week has been dubbed "Black October".

"Like the sky is falling"

"I no longer think we're going to be able to patch all bugs," said Sam Altman, the head of OpenAI, on Thursday evening.

Jason Clinton, deputy chief information security officer at Anthropic, said the coming months would bring a "vulnerability tsunami". "There won't be enough time to patch critical infrastructure," he wrote on X. Marc Benioff, chief executive of Salesforce, called it a "code red".

Matthew Prince, the chief executive of the internet security company Cloudflare, said AI could find flaws at a pace that would feel catastrophic, because defenders would not be able to keep up. "It's going to feel like the sky is falling. It's going to feel like there's nothing we can do," he wrote. "The next two years are going to be incredibly, incredibly, incredibly fraught with new tools that have infinite patience to go look for vulnerabilities across the internet."

Millions of attempts

Attempts to exploit the PHP flaw are already under way. Mr Prince said Cloudflare had seen thousands of attempts in the ten hours before the flaw was announced. "That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now," he said.

Researchers at the security company Wiz described it as "among the most severe vulnerabilities discovered in PHP, and arguably in software history". "The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve," they wrote.

After the flaw was announced, government and private websites in the US and UK were taken down temporarily so they could be patched. The US National Security Agency told anyone running PHP to install the fix immediately, warning that attackers could use the flaw to "steal sensitive data, disrupt services or move deeper into a network".

A double-edged tool

Security experts have warned for months that AI would make it far easier to find software bugs, a prospect sometimes called the "vulnpocalypse". But the PHP flaw is the first time AI has helped uncover a weakness as fundamental and widespread as this. The same tools that help defenders find bugs can help criminals and hostile states exploit them, and the industry fears attackers will be quicker off the mark.

What organisations should do

The UK's National Cyber Security Centre has urged organisations to apply the PHP update immediately and to check their systems for signs that attackers may already have got in. Small businesses that rely on an outside web developer or hosting company are advised to contact them to confirm that their sites have been updated, and to make sure that backups are up to date.