A software flaw found with the help of an OpenAI model forced government websites across Europe and elsewhere offline this week, in one of the most prominent demonstrations yet of AI's ability to surface security bugs at scale. The weakness was in PHP, a decades-old programming language that powers a large share of the internet. Operators rushed to patch, and some that felt they could not fix the flaw before attackers exploited it simply took their sites down until they could be made safe. Reuters reported the disruption beginning Wednesday, citing seven cybersecurity professionals who expect more outages of the same kind.
The episode is being read as a preview rather than an isolated event. VulnCheck, a Massachusetts threat-intelligence firm, says AI helped drive a doubling in the number of digital flaws discovered year on year, in research due for publication in the coming days. Cloudflare chief executive Matthew Prince told Reuters he was aware of "a bunch of additional severe vulnerabilities" in other critical software and predicted a rough stretch ahead. "I think we're going to have a couple of years where every single week it's going to feel like the sky is falling," he said.
What has changed is speed, not just volume. Finding a bug once required real skill, and turning it into a working exploit could take an experienced professional weeks or months, giving defenders room to patch calmly. Models can now scan codebases around the clock and produce exploits in hours. "What's fundamentally, and unquestionably, changing is the timescale," said Shane Fry of RunSafe Security. The same week brought disclosed weaknesses in the PHP alternative Node.js and the streaming program Plex, plus breaches tied to the AI gateway LiteLLM and the platform Railway.
Michael Daniel, president of the Cyber Threat Alliance and a former White House cybersecurity coordinator, framed the PHP case as "tech debt coming due." Organizations have kept old software running because its risks never appeared as a direct cost, he told AFP; AI is now forcing that bill to be paid. His advice to smaller organizations is to shift toward accepting vendor updates as fast as they arrive, because the old practice of exhaustively testing every patch before deployment no longer fits the compressed timeline.
Not everyone expects a free-for-all. Daniel Stenberg, lead developer of the file-transfer tool curl, argues that AI-found bugs tend to be exotic and hard for ordinary attackers to weaponize, and ArmorCode's Ramy Rahman notes that more disclosed vulnerabilities do not automatically mean more successful attacks. There is tentative support for that view: as of Thursday afternoon, the firm Hunt.io said criminals it tracked had not yet built a working tool to exploit the PHP flaw, though Prince said he had seen anecdotal evidence of compromises. The disagreement sharpens a theme AI Daily examined earlier this month, when exploits began arriving before patches. Both camps agree defenders' timelines are shrinking; they differ on how much damage follows.