Researchers this week disclosed a critical vulnerability in PHP, a widely used programming language that powers millions of websites, after employing artificial intelligence to help identify coding flaws. The discovery, which some in the industry have dubbed “Black October,” has prompted senior figures across tech and security to warn that AI tools will both accelerate the discovery of bugs and lower the bar for their exploitation.
“I no longer think we’re going to be able to patch all bugs,” Sam Altman said on Thursday evening, echoing concerns voiced by other executives. Some security leaders have described the potential fallout as a “vulnerability tsunami,” arguing that AI will enable attackers to find and weaponize previously obscure or long-standing defects at unprecedented speed.
AI accelerant
Researchers said they used AI assistance to surface critical flaws in PHP that may have remained unpatched for years. While the precise technical details have been disclosed by the research teams, the broader implication cited by security professionals is that machine learning tools can rapidly scan vast codebases and suggest exploits, dramatically increasing the number of high-risk vulnerabilities discovered in widely deployed software.
Industry response and implications
Executives and cybersecurity leaders are urging a reassessment of current security practices, warning that traditional patch-management approaches may not scale to meet the new pace of discovery. They predict that organisations and infrastructure providers will face heightened pressure to detect, triage and remediate vulnerabilities more quickly, even as attackers gain access to similarly powerful tools.
Calls for coordinated action have grown louder amid the disclosures, with observers saying governments, open-source maintainers and private companies may need to collaborate more closely on threat intelligence, automated testing and defensive tooling. At the same time, experts caution that premature or incomplete fixes could introduce new problems, underscoring the complexity of securing critical internet infrastructure in the age of AI.