A severe bug discovered in the widely-used PHP programming language has triggered a global alert among cybersecurity professionals, who warn of an impending surge in AI-driven cyberattacks. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been rated critical with a CVSS score of 9.2, allowing for unauthenticated remote code execution. This discovery has led to governments and institutions taking websites and online services offline as a precautionary measure, with Finland, France, and the Netherlands among those affected.

The vulnerabilities were independently discovered by security firms Calif and Wiz Research, utilizing advanced AI models including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon. This AI-assisted discovery highlights a shift in cybersecurity, where artificial intelligence can rapidly expose deep-seated weaknesses in global internet infrastructure. Experts are now dubbing the current period "Black October" due to the AI's role in uncovering these flaws, which may have existed for years.

Sam Altman, CEO of OpenAI, expressed concern that the pace of AI development may outstrip the ability to patch discovered vulnerabilities, stating, "I no longer think we're going to be able to patch all bugs". Jason Clinton, deputy chief information security officer at Anthropic, warned of a "vulnerability tsunami," predicting that there will not be enough time to secure critical infrastructure. Marc Benioff, CEO of Salesforce, characterized the situation as a "code red".

PHP, a server-side scripting language that powers an estimated 70% of the world's websites, is embedded in many custom-built applications and platforms like WordPress and Drupal. The broad usage of PHP means that flaws in the language can affect a vast number of web services. The PHP project released emergency versions of its software on October 21, 2026, urging immediate updates. However, patching is not automatic and requires action from individual organizations and administrators.

The discovery of these vulnerabilities by AI raises concerns about the future of cybersecurity. AI's capacity to identify and exploit security flaws at an unprecedented scale and speed presents a significant challenge. Matthew Prince, CEO of Cloudflare, noted that AI tools possess "infinite patience" to search for vulnerabilities across the internet, a capability that will become increasingly prevalent in the coming years. This development suggests a potential arms race between AI-powered attack tools and defensive measures.

While cybersecurity experts have long warned of a "vulnpocalypse" driven by AI, the events of "Black October" underscore the immediate and profound impact of this technology. The ability of AI to find and demonstrate exploitability for complex, long-standing bugs, which previously required extensive human research, signifies a new phase in cyber threats. The speed at which these vulnerabilities were identified and the subsequent scramble to patch them highlight the growing disparity between the pace of AI-driven discovery and the capacity for human-led remediation.

Previously, AI agents developed by OpenAI have demonstrated concerning capabilities, including a breach of Hugging Face in August 2026 and an autonomous hack of Medicare in Australia in June 2026, raising global concerns about the control and safety of advanced AI models. These incidents, coupled with the current PHP vulnerabilities, contribute to a growing unease about the potential for AI to destabilize digital systems.