Science & Tech · Cybersecurity · 5 mins ago
AI-driven vulnerability discoveries raise risk of more internet outages
AI tools are uncovering software vulnerabilities faster, including flaws that may have stayed hidden for years.
A serious weakness in PHP, a programming language used across much of the internet, was linked to outages at government websites in Europe and elsewhere starting Oct.
21.
Some operators took sites offline while they worked to make them safe, as others rushed to install fixes.
Researchers also disclosed problems involving other software and online services during the same week.
AI can help attackers turn flaws into working exploits in hours, leaving defenders less time to respond than they once had.
Experts disagree about whether more disclosed flaws will lead to more successful attacks, because some vulnerabilities are difficult to exploit.
Cybersecurity teams are likely to face more urgent patching work as AI continues to expose weaknesses in internet-facing software.
AI tools helped uncover serious vulnerabilities in PHP, prompting outages and emergency fixes at websites around the world.
The disruption began on Oct. 21 after weaknesses were discovered in PHP, which powers a large share of the internet.
Cloudflare CEO Matthew Prince warned that similar security crises could occur weekly for the next few years.
Researchers said AI can find software flaws and help develop working exploits in hours, shortening defenders’ time to respond.
Experts disagreed on whether the increase in disclosed vulnerabilities will lead to more successful cyberattacks.
- Who
- Website operators and cybersecurity professionals are responding to vulnerabilities found with help from AI.
- What
- PHP flaws triggered outages and an urgent patching effort; experts warn AI may accelerate the discovery and exploitation of other vulnerabilities.
- When
- The outages began on Oct. 21, 2026. Reports were published on Oct. 23 and 24.
- Where
- Government websites in Europe and elsewhere, as well as other online services.
- Why
- AI tools helped uncover PHP weaknesses, prompting operators to patch systems or take some websites offline to reduce the risk of exploitation.
Cybersecurity professionals warning of greater attack risk
Experts cautioning against assuming more flaws mean more attacks
Risk of attacks
Cybersecurity professionals warning of greater attack risk
Matthew Prince warned that similar crises could feel weekly for the next few years as AI accelerates vulnerability discovery.
Experts cautioning against assuming more flaws mean more attacks
Daniel Stenberg said AI-found flaws tend to be exotic and difficult for rogue actors to exploit.
Meaning of more disclosures
Cybersecurity professionals warning of greater attack risk
Shane Fry said AI is changing how quickly vulnerabilities can be found and weaponised.
Experts cautioning against assuming more flaws mean more attacks
Ramy Rahman said more disclosed vulnerabilities do not automatically mean more successful attacks.
Outages began across government websites in Europe and elsewhere after vulnerabilities in PHP were discovered.
Website operators rushed to patch PHP, while some took sites offline until they could make them safe.
The Straits Times and PC Gamer published reports on AI-assisted vulnerability discovery and the risk of further disruption.
Politico Europe published a report on the cyber flaw scramble.
- Affected software
- PHP, a programming language used by roughly 70% of the world's websites, according to some estimates
- Outage start
- Oct. 21, 2026
- Warning
- Matthew Prince said every week could feel like the sky is falling for a couple of years
- AI-assisted research
- Wiz Research said it developed and adapted working exploits across multiple applications in hours
- Vulnerability trend
- VulnCheck research was reported to show a year-on-year doubling of digital flaws discovered
- Additional affected software
- Disclosures this week included vulnerabilities in Node.js and Plex, and breaches tied to LiteLLM and Railway
4 sources
Inside the cyber flaw scramble that brought the AI threat to life
“20년 숨은 보안 결함도 AI가 찾는다”… PHP 사태로 본 ‘버그마게돈’ 공포
'Every single week it's going to feel like the sky is falling': Cloudflare CEO says strap in for 'a couple years' of AI-powered internet security mayhem
AI is unearthing internet’s hidden flaws – and more outages may follow
What people are saying
I think we're going to have a couple years where every single week it's going to feel like the sky is falling
Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours
What’s fundamentally, and unquestionably, changing is the timescale for not only finding vulnerabilities, but how quickly adversaries can weaponise them
more disclosed vulnerabilities do not automatically mean more successful attacks
Posts on X
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.