How AI Turned a 22-Year Sleepwalker Bug Into a 48-Hour Crisis

The Clock Got Shorter

A bug slept in PHP for twenty-two years. Nobody noticed because nobody could follow the chain of exploits it required — a sequence so complex that even seasoned human researchers hit a ceiling on what they could practically achieve.

Then AI arrived.

In October 2026, that dormant vulnerability became the centerpiece of what cybersecurity insiders are already calling “Black October.” Within forty-eight hours of the flaw being disclosed, malicious actors had attempted exploitation millions of times. Governments in the US and UK temporarily took down sites. The NSA issued an emergency alert. And a generation of tech leaders publicly acknowledged something most of them had been quietly preparing for: the rules of internet security had just changed, and not in anyone’s favor.

The non-obvious implication here isn’t that AI can find bugs. It’s that AI has collapsed the timeline between discovery and exploitation from years — or decades — into days. That compression is what makes this moment qualitatively different from every vulnerability scramble before it.

A Language the Internet Didn’t Know It Still Needed

PHP runs roughly seventy percent of all websites on the internet. That figure comes from multiple experts estimating the reach of a programming language most people assumed was already being phased out. It wasn’t. WordPress, legacy e-commerce platforms, government portals, hospital systems — the list of critical infrastructure still depending on PHP is long and not particularly glamorous, which is exactly why it’s dangerous.

The vulnerabilities announced on October 21st weren’t edge-case issues. They were fundamental flaws in the language itself, present for over two decades, requiring an exploit chain so intricate that human researchers could see the path but never walk it.

Researchers at AI security platform Wiz called it “among the most severe vulnerabilities discovered in PHP, and arguably in software history.” The phrasing matters. “Arguably” is a qualifier, but in this context it’s doing heavy lifting — because the severity doesn’t depend on whether you compare it to SQL Slammer in 2003 or the SolarWinds attack. It depends on what happens when the next wave of tools arrives that don’t just find these chains but execute them autonomously.

The Numbers That Should Keep You Up

Cloudflare CEO Matthew Prince documented the attack surface expanding in real time. In the ten hours before the vulnerability was publicly announced, Cloudflare saw evidence of thousands of exploitation attempts. Forty-five minutes after the announcement, that jumped to tens of thousands. Two hours in: hundreds of thousands. By the time Prince posted, the number was in the millions.

That velocity — from thousands to millions in under three hours — isn’t just impressive. It’s the baseline for what comes next.

The NSA warned that such an access vector could help attackers steal sensitive data, disrupt services, or move deeper into networks. In plain English: this isn’t a vulnerability you patch and forget. It’s a doorway that, once opened, doesn’t close.

“The Sky Is Falling” and Nobody Can Fix It Fast Enough

Sam Altman said it bluntly on Thursday evening: “I no longer think we’re going to be able to patch all bugs.” That’s not the statement of a person who’d given up. It’s the statement of someone who’d just watched the math change.

Jason Clinton, Anthropic’s deputy chief information security officer, predicted a “vulnerability tsunami” in the months ahead. Marc Benioff called it “code red.” Prince wrote that the next two years would be “incredibly, incredibly, incredibly fraught” with tools that have “infinite patience” to hunt for weaknesses across the internet.

The repetition in Prince’s language isn’t stylistic. It’s the verbal equivalent of someone trying to convince themselves they’re not understating the problem.

Here’s what those warnings share: they’re not about a single vulnerability. They’re about the pace at which new vulnerabilities will be discovered and the impossibility of defending against that pace with current security infrastructure. A human research team can spend months on a single exploit chain. An AI system can run millions of them in parallel, forever, without fatigue.

Who Wins, Who Loses, and What Happens Next

The winners in this scenario are the actors with the most compute and the fewest constraints. That includes nation-states, organized cybercrime, and well-funded ethical researchers working against the clock. It does not include small businesses running PHP stacks on outdated frameworks, hospitals relying on legacy systems, or anyone who patched their website last Tuesday.

The losers are everyone who assumed that the decades-long track record of PHP security meant PHP was safe. It wasn’t. It just meant no one had the tools to prove otherwise until now.

What happens next is the harder question. The immediate response — emergency patches, temporary site shutdowns, NSA alerts — is the playbook everyone knows. The question is whether that playbook scales to a world where new critical vulnerabilities are being found at machine speed.

Clinton’s warning that there won’t be enough time to patch critical infrastructure isn’t alarmism. It’s a forecast based on the observed trajectory. If the PHP vulnerability is any indicator, the window between discovery and mass exploitation is measured in hours, not weeks. The security industry’s response time hasn’t moved at that speed before, and there’s no obvious reason it will now.

The second-order crisis is coming. We just don’t know what it looks like yet.