Experts Warn Ai-powered Hacking Could Make October a Cybersecurity Flashpoint

WHO:

Vox Tech - Cybersecurity experts warned that AI’s hacking abilities are becoming more sophisticated and far-reaching.

The Guardian - Sam Altman said, “I no longer think we’re going to be able to patch all bugs.”

The Guardian - Jason Clinton, Anthropic’s deputy chief information security officer, predicted a “vulnerability tsunami” and said, “There won’t be enough time to patch critical infrastructure.”

The Guardian - Marc Benioff, Salesforce CEO, described the situation as a “code red.”

The Guardian - Matthew Prince, Cloudflare CEO, warned that AI could find security flaws at a pace that overwhelms the security community. He said, “It’s going to feel like the sky is falling. It’s going to feel like there’s nothing we can do,” and wrote that the next two years would be “incredibly, incredibly, incredibly fraught.”

The Guardian - Researchers at AI security platform Wiz called the PHP flaws among the most severe vulnerabilities discovered in PHP and “arguably in software history.”

WHAT:

Vox Tech - Cybersecurity experts raised concerns about a possible “Black October,” following a string of alarming incidents involving AI-enabled hacking.

The Guardian - Researchers used AI to help identify critical flaws in PHP, a programming language used across millions of websites; the flaws may have remained unpatched for years.

The Guardian - Experts estimated that 70% of websites on the internet may have been at risk of hacking.

The Guardian - Attempts to exploit the PHP vulnerability had begun. Government and private websites in the US and UK temporarily took their sites down to patch the bugs.

The Guardian - The NSA advised sites running PHP to implement patches immediately and warned that attackers could use the flaws to access servers without authorization, steal sensitive data, disrupt services, or move deeper into networks.

The Guardian - Prince said Cloudflare observed thousands of attempts to exploit the PHP flaws before disclosure, tens of thousands within 45 minutes after disclosure, hundreds of thousands within two hours, and millions afterward.

WHY:

The Guardian - Experts warned that AI could help malicious actors identify and exploit vulnerabilities at unprecedented scale and speed, faster than defenders can address them.

The Guardian - Wiz researchers said demonstrating the PHP flaws’ exploitability required an exceptionally complex chain of steps, beyond what human researchers could practically achieve.

HOW:

The Guardian - AI assisted researchers in finding the PHP flaws; experts warned that the same capabilities could be used by attackers to locate and exploit bugs.

The Guardian - Wiz researchers said the underlying flaws had been present for decades.

(UPDATED October 23, 2026 23:20 UTC)

Cybersecurity experts are warning that AI-powered hacking is becoming more sophisticated, after researchers used AI to uncover critical flaws in PHP, software used by millions of websites. The bugs had been present for decades and may have gone unpatched for years; experts estimated that as many as 70 percent of websites could have been at risk. Researchers said exploiting the flaws required an exceptionally complex chain of steps, but attackers have already tried to take advantage. Cloudflare observed millions of attempts after the vulnerabilities were disclosed. US and UK government and private websites temporarily went offline to install fixes, and the NSA urged sites running PHP to patch immediately, warning attackers could steal data, disrupt services, or gain deeper access to networks. Sam Altman said he no longer believes every bug can be patched. Experts warn AI may help attackers find vulnerabilities faster than defenders can respond.