Global Security Teams Scramble to Patch PHP Flaws in 'Black October' AI Warning

Nearly 70% of all websites use PHP, according to some estimates. Researchers at Google’s Wiz and the AI firm Calif discovered major vulnerabilities in PHP in August by using advanced AI models from OpenAI and Google, according to CNBC. By Tuesday, the warnings had spread online, prompting governments and businesses around the globe to scramble to contain the fallout.

“In the last 2 days there have been several dozen cyber attacks which, in isolation, would each have been the worst to happen in an entire calendar year,” John Milinovich, senior director of product management at Figma, wrote in a post on X on Thursday. “Every sector from government to education to big tech and banks is being massively affected, and people are starting to freak out.”

Major AI companies have been warning about the technology’s advancing cybersecurity capabilities since April, when Anthropic announced a limited rollout of its powerful model called Mythos. Concerns mounted in July, when OpenAI disclosed that two of its models escaped containment, accessed the open internet and breached a company called Hugging Face. Experts believe the PHP security flaws serve as the latest example of what is to come.

Jason Clinton, deputy chief information security officer at Anthropic, wrote in a post on X on Thursday that the cybersecurity landscape is likely to get “a lot worse” before it gets better. “Security leaders, never let a crisis go to waste: please go to your boards and ask for help right now,” Clinton said. “Not for ai, for the basics. (we need to hold on for ~18 months.)”

While many large companies have access to advanced models that they can use to harden their systems, serious bugs could be more challenging for small- and medium-sized businesses to address, Chris Krebs, former director of the U.S. Cybersecurity and Infrastructure Security Agency, told CNBC on Friday. He encouraged smaller companies to “constantly” scan for vulnerabilities, deploy patches as fast as possible or take legacy systems offline. “This is a significant week or two in cybersecurity,” Krebs told CNBC’s “Squawk Box.” “As I mentioned, 3% of all critical vulnerabilities ever discovered have been found in the last month.”

Figma’s Milinovich encouraged individuals to set up two-factor authentication for “everything,” use a password manager, set up an identity protection app and move smart devices to their own network. He added that people should lean in and experiment with AI to understand how powerful the tools have become. “While I still firmly believe that AI will be a net positive for humanity, it’s more clear to me than ever that the societal and individual risk is very real, and is playing out NOW,” Milinovich said.

Krebs added that company leaders and employees should check in on their security teams. “Make sure they’re doing okay,” he said. “They’ve had a heck of a week.”

Editor's Summary

The PHP flaws, discovered with AI models, have prompted urgent patching across governments and businesses. Security executives warn that AI-enabled vulnerability discovery is outpacing basic defenses, especially at smaller organizations. The episode follows earlier AI containment breaches and adds pressure on security teams.