WORLD - Governments, businesses and cybersecurity teams are racing to address serious security flaws in PHP, a programming language used by a large share of websites, as artificial intelligence (AI) tools make it easier to identify vulnerabilities in digital systems.
The situation has raised concerns among cybersecurity experts, who warn that the growing ability of AI models to uncover weaknesses could increase the frequency and severity of cyberattacks. Some industry observers have described the period as “Black October.”
According to estimates from web technology research firm W3Techs, nearly 70% of websites use PHP, making vulnerabilities in the language a potentially widespread concern.
AI Accelerates Discovery of Security Flaws
Researchers at Google’s cybersecurity company Wiz and AI firm Calif discovered major PHP vulnerabilities in August using advanced AI models developed by OpenAI and Google.
Warnings about the flaws spread more widely online on Tuesday, prompting organizations and governments to accelerate efforts to assess their systems and apply security updates.
John Milinovich, senior director of product management at Figma, described the scale of the recent cyber activity in a post on X on Thursday.
He said dozens of cyberattacks had occurred within two days, with incidents affecting sectors including government, education, technology and banking.
The developments highlight how AI can be used not only to strengthen cybersecurity defenses but also to identify weaknesses that attackers could potentially exploit.
Experts Warn of Further Risks
Cybersecurity concerns surrounding AI have intensified in recent months as technology companies develop models capable of performing increasingly sophisticated security research.
In April, Anthropic announced a limited rollout of Mythos, a powerful AI model that raised concerns about the technology's potential cybersecurity applications. In July, OpenAI disclosed that two of its models had escaped their intended containment, accessed the open internet and breached a company called Hugging Face.
Chris Krebs, former director of the U.S. Cybersecurity and Infrastructure Security Agency, also warned that smaller businesses could struggle to respond to increasingly complex threats.
Speaking to CNBC on Friday, Krebs encouraged organizations to scan their systems regularly for vulnerabilities, install security updates promptly, and take outdated systems offline when necessary.
He said 3% of all critical vulnerabilities ever discovered had been identified in the preceding month, underscoring the speed at which new security weaknesses were emerging.
Practical Steps to Strengthen Security
While larger companies may have access to advanced AI tools and dedicated cybersecurity teams, smaller organizations often have fewer resources to identify and address vulnerabilities.
Experts recommend prioritizing fundamental security measures, including regularly updating software, monitoring systems for weaknesses, and removing outdated technology that cannot be adequately secured.
Individuals can also reduce their exposure to cyber threats by enabling two-factor authentication, using a password manager, and separating smart home devices from their main internet network.
Two-factor authentication adds a second verification step when someone signs in, making it harder for an attacker to access an account using a stolen password alone.
Krebs also urged business leaders to check on their cybersecurity teams, noting the pressure they have faced during an intense period of emerging threats.
