What happened
On October 21, a serious vulnerability was made public in the PHP programming language, which underpins millions of websites, according to The Guardian. The flaw may have gone unpatched for years, exposing to intrusion risk a share of sites that some experts cited by the source estimate at 70% of the total. The episode has been called "Black October" and, according to the newspaper, marks the first time researchers have used artificial intelligence tools to identify such a fundamental and critical defect in this field.
The discovery was not isolated: after the announcement, government and private-sector websites in the United States and the United Kingdom temporarily suspended operations to apply the patches. The U.S. National Security Agency (NSA) issued an advisory asking every PHP-based site to install the updates immediately, warning that malicious actors could exploit the flaws to access servers without authorization, steal sensitive data, disrupt services, or penetrate deeper into networks. According to researchers at the security platform Wiz, cited by The Guardian, this is one of the most serious vulnerabilities ever discovered in PHP and, in their judgment, in the history of software: the defects are said to have been present for decades, but demonstrating their exploitability required a chain of steps so complex that it was at the limit of human capabilities.
The tech leaders' warning
The leaders of several major technology companies amplified the alarm, with their statements reported by the source. Sam Altman said he no longer believes it is possible to correct all the flaws. Jason Clinton, deputy head of cybersecurity at Anthropic, predicted a "tsunami of vulnerabilities" for the coming months, arguing that there will not be enough time to secure critical infrastructure. Marc Benioff, chief executive of Salesforce, spoke of a "code red."
Matthew Prince, chief executive of Cloudflare, explained that AI can identify defects at a speed and in a manner that will appear catastrophic, because the security community will not be able to keep up. In the next two years, he wrote, tools with infinite patience in searching for vulnerabilities on the Internet will arrive. The same company provided a concrete figure on the race to exploitation: in the ten hours before the announcement, attack attempts had been detected in the thousands, rising to tens of thousands in the following 45 minutes, to hundreds of thousands within two hours, and now to millions.
Why it matters and what remains unclear
The central point is the symmetry of risk: the same AI capability to uncover defects at unprecedented rates can be used by hostile actors to exploit them just as quickly, as the attack attempts already underway demonstrate. The novelty is not only the single flaw, but the fact that for the first time AI has been used to identify a defect of this magnitude, turning a risk anticipated for months into an operational emergency.
However, open questions remain that the material does not clarify: it does not indicate how many installations have already been updated or how solid the estimate that 70% of sites are at risk is. Nor is the actual impact of successful attacks documented. The predictions of a "tsunami" and a "code red" are statements by executives, not verified data, and should be read as such. The source also does not specify which AI tools were used for the discovery or how the release of patches was coordinated.
