The cybersecurity world braced for catastrophe after AI uncovered critical flaws in PHP, the language behind roughly 70% of websites, but the anticipated wave of automated attacks has surprisingly struggled to get off the ground. Security researchers say the vulnerabilities have proven unusually difficult to exploit, drawing comparisons to the Y2K phenomenon where warnings of armageddon helped rally companies to engineer a solution in time. However, experts caution this is a temporary reprieve, with one warning that 'we don't have to wait another two years before this happens (again), it could be three hours from now.'
Last week's disclosure of two critical bugs in PHP by OpenAI's agents and the PHP Foundation triggered what experts have dubbed 'Black October,' with France and Finland temporarily pulling access to certain websites and the US National Security Agency warning organizations to patch the flaws immediately. Cloudflare reported millions of attempts to exploit the vulnerability. Yet, as Axios reports, the bugs have proved unusually difficult to exploit, and many organisations have patched effectively.
'We don't have to wait another two years before this happens (again),' Samantha Lewis, head of threat intelligence at Armadin, told Axios. 'It could be three hours from now that the next one of these launches.'
Tomer Schwartz, CTO of Exposure Management & AppSec at Google-owned Wiz, who was part of the scramble to fix the bugs, told TechCrunch's Equity podcast that this is only the beginning. TechCrunch's episode summary describes how a bug sat in plain sight for more than a decade and says AI changes how quickly novel vulnerabilities can be uncovered and exploited. Wiz could not have found the bugs without AI, he said.
The shift toward resilience is key. 'This is the worst outlook I've ever had, and it also is the most interesting thing I've ever seen in my life,' ExtraHop CEO Greg Clark told Axios. 'This stuff actually works, it's going to change everything.' Rubrik CEO Bipul Sinha warned of an 'era of cyber tsunami,' saying 'it will wash over everybody, nobody will be 100% safe.'
Meanwhile, breaches at AI coding agent OpenCode, developer platform Railway and AI gateway LiteLLM put customers' API keys and other credentials at risk. Rob Joyce, former head of the NSA's cyber division, warned on X that the 'transition from vulpocalypse to breachpocalypse is here.'
Experts recommend doubling down on basics: multi-factor authentication, unique passwords, and keeping devices updated. Jonathan Riss, an OSINT and blockchain intelligence analyst at CertiK, told Magazine that 'finding vulnerabilities faster does not automatically give us the capacity to resolve them faster.' The structural burden, he said, 'sits with platforms and providers.'
The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.
§
Analysis
Why This Matters
The difficulty of exploiting these particular bugs does not eliminate the broader threat: AI is dramatically lowering the barrier to discovering and exploiting vulnerabilities, meaning similar crises could emerge at any time.
The 'Black October' response highlights how coordination and basic cyber hygiene can mitigate risk, but the underlying infrastructure remains fragile, with single weaknesses capable of exposing many organisations.
For ordinary internet users, the event underscores the importance of personal security measures (MFA, password hygiene, limiting attack surface) and the need to prepare for potential disruptions to critical services.
Background
The 'Black October' scare began on Oct. 21 when the PHP Foundation disclosed critical vulnerabilities in PHP, a programming language used by roughly 70% of websites. The flaws were discovered with AI assistance from OpenAI and the research group Calif, among others. Panic spread as Cloudflare reported millions of exploit attempts, and some governments took precautionary measures. However, as of late October, the vulnerabilities have proven hard to exploit, leading some to compare the event to the Y2K scare, where preparation averted catastrophe. Security leaders warn this is a temporary grace period.
Key Perspectives
Samantha Lewis (Armadin): 'We don't have to wait another two years before this happens (again), it could be three hours from now that the next one of these launches.'
Greg Clark (ExtraHop): 'This is the worst outlook I've ever had, and it also is the most interesting thing I've ever seen in my life. This stuff actually works, it's going to change everything.'
Bipul Sinha (Rubrik): The world is in an 'era of cyber tsunami' that 'will wash over everybody, nobody will be 100% safe.'
Tomer Schwartz (Wiz): This is only the beginning. AI changes how quickly novel vulnerabilities can be uncovered, and patching by hand will not scale.
Justin Timothy (GuidePoint Security): Companies should double down on basic cyber principles such as using multi-factor authentication.
Jonathan Riss (CertiK): 'Finding vulnerabilities faster does not automatically give us the capacity to resolve them faster.'
What to Watch
Whether the next AI-discovered vulnerability will be more easily exploitable, potentially triggering a 'breachpocalypse' as Jim Joyce warned.
How quickly organisations patch remaining unpatched systems, particularly small businesses running WordPress, which Tomer Schwartz flagged as still vulnerable.
The development of automated, resilient defense systems capable of operating at machine speed to counter AI-driven attacks.
12 claims in this story checked against 3 sources: 8 supported.
Show each claim
SupportedThe headline says the PHP bugs proved hard to exploit and experts warned of a coming “vulnpocalypse.”Axios: “Security researchers say the PHP vulnerabilities that prompted widespread panic last week have proven unusually difficult to exploit”
SupportedThe summary says the anticipated wave of automated attacks struggled to get off the ground and the current reprieve is temporary.Axios: “the anticipated wave of automated attacks has surprisingly struggled to get off the ground”
Partly supportedThe opening combines two parts of Samantha Lewis’s statement into one direct quote, changing the punctuation and capitalization.Axios: ““We don't have to wait another two years before this happens (again),” she said. “It could be three hours from now that the next one of these launches.””
SupportedThe opening compares the response to Y2K, saying warnings of catastrophe helped rally companies to engineer a solution in time.Axios: “The last week has unfolded in ways that remind some researchers of the Y2K phenomenon, a software problem in 1999 where warnings of armageddon helped rally companies to engineer a solution in time.”
SupportedThe story says the bugs’ difficulty exploiting them is a temporary reprieve, quoting Lewis that the next such event could happen in three hours.Axios: “It could be three hours from now that the next one of these launches.”
Partly supportedThe story says OpenAI’s agents and the PHP Foundation disclosed the two critical PHP bugs.Cointelegraph.com News: “When critical vulnerabilities in PHP, the programming language used by around 70% of websites, were uncovered with the help of AI tools and disclosed by the PHP Foundation on Oct. 21”
SupportedThe story says France and Finland temporarily pulled access to certain websites and the NSA warned organizations to patch the flaws immediately.Cointelegraph.com News: “Some countries, including France and Finland, temporarily pulled access to certain websites while the US National Security Agency (NSA) warned organizations to patch the flaws immediately or take affected systems offline.”
SupportedThe story says Cloudflare reported millions of attempts to exploit the vulnerability.Cointelegraph.com News: “Cloud services provider Cloudflare reported millions of attempts to exploit the vulnerability after its disclosure”
Partly supportedThe story says many organizations patched effectively.Axios: “The defense work at many companies to address the issue also appears to have helped.”
Partly supportedThe story attributes to Tomer Schwartz the claim that the PHP bugs are only the beginning.AI News & Artificial Intelligence | TechCrunch: “According to researchers who found the bugs, this is only the beginning, as AI changes how quickly novel vulnerabilities can be uncovered and exploited.”
SupportedGreg Clark said, “This is the worst outlook I've ever had, and it also is the most interesting thing I've ever seen in my life,” and “This stuff actually works, it's going to change everything.”Axios: ““This is the worst outlook I've ever had, and it also is the most interesting thing I've ever seen in my life,” ExtraHop CEO Greg Clark told Axios. “This stuff actually works, it's going to change everything.””
Correction
An earlier version of this story presented wording from TechCrunch's podcast summary as a direct quote from Tomer Schwartz. The wording was a summary of a topic discussed on the podcast.
