A coordinated disclosure of severe security flaws in core web infrastructure has sparked a global race to protect millions of servers, with industry leaders warning that artificial intelligence is ushering in a destabilizing new era of automated cyberattacks.
The alert centers on PHP, an open-source programming language that underpins approximately 70 percent of the world’s websites, including major publishing platforms such as WordPress, Drupal, and MediaWiki. Researchers announced on Wednesday, Oct. 21, that they had identified critical memory-handling flaws that allow unauthenticated attackers to read sensitive server memory — including passwords, security tokens, and encryption keys — or achieve remote code execution across affected deployments.
While variations of the underlying coding errors had lingered quietly in PHP for more than two decades, taking advantage of them historically demanded an extraordinary sequence of manual steps. Researchers demonstrated that modern AI systems have shattered that protective barrier, generating functional exploit chains in a matter of days.
The Arrival of ‘Black October’
The discovery was made by researchers at AI security firm Calif and Google-backed Wiz, working alongside OpenAI through its Patch the Planet security initiative. Using advanced models including OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon, the teams mapped out how fatal out-of-memory errors in PHP left corrupted request data behind in server memory, which subsequent web requests could manipulate.
In a blog post, Wiz described the findings as “among the most severe vulnerabilities discovered in PHP, and arguably in software history.” The group demonstrated unauthenticated remote takeover scripts, dubbed PHP2Shell, against current versions of WordPress, Joomla, and Drupal, while noting that even basic applications running on vulnerable PHP installations remained exposed.
The technical ease with which AI synthesized working attacks has stunned veteran cybersecurity specialists, who have dubbed the period “Black October.” During an appearance on CNBC’s “Squawk Box,” Chris Krebs, the former director of the U.S. Cybersecurity and Infrastructure Security Agency, said that three percent of all critical vulnerabilities ever recorded in software history were uncovered in the past month alone.
A Surge in Malicious Exploitation
Although developers issued official software updates on Wednesday to address the vulnerabilities, malicious activity escalated almost immediately. Cloudflare Chief Executive Matthew Prince posted on social media platform X that his firm tracked thousands of exploit attempts in the ten hours before public disclosure, escalating to “tens of thousands in the 45 minutes post announcement” and reaching into the millions shortly thereafter.
The U.S. National Security Agency issued an urgent advisory urging system administrators to apply patches immediately. The agency warned that the vulnerability provides an access point that could allow unauthorized actors to “steal sensitive data, disrupt services or move deeper into a network,” according to The Guardian. In response, numerous private businesses and government agencies in the U.S. and Britain temporarily pulled web portals offline to apply emergency updates.
“The next two years are going to be incredibly, incredibly, incredibly fraught with new tools that have infinite patience to go look for vulnerabilities across the Internet,” Prince wrote.
Fears of a Defense Deficit
The incident has intensified concerns across the technology sector that defensive teams are being hopelessly outpaced by AI-driven offense. Marc Benioff, the chief executive of Salesforce, labeled the situation a “code red,” while OpenAI Chief Executive Sam Altman expressed skepticism about the industry’s ability to keep up. “I no longer think we’re going to be able to patch all bugs,” Altman said on Thursday evening, according to The Guardian.
Jason Clinton, deputy chief information security officer at Anthropic, posted on X that the coming months will bring a “vulnerability tsunami” and warned that “there won’t be enough time to patch critical infrastructure.” Industry leaders noted that Anthropic had already paused the rollout of its Mythos model in June after the U.S. government flagged its potent vulnerability-hunting skills as a national security risk.
What remains uncertain is how quickly organizations worldwide can update legacy systems that cannot easily be upgraded. With vast portions of the global web running on outdated infrastructure that requires extensive manual rebuilding, security experts warn that millions of online servers remain wide open to automated weaponization as attackers refine their own AI tools.
