AI-discovered flaws in PHP trigger a global cyber-security scramble dubbed Black October

Websites used every day may have been vulnerable to hackers for years because of hidden flaws in their code that artificial intelligence only recently discovered¹. The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data such as passwords or take control of affected servers¹.

A potential attack exploiting the flaws emerged on Wednesday, prompting governments and companies to temporarily take their websites offline while they installed security patches¹. Dozens of websites in the United States, Britain and around the world were briefly taken offline to make the fix¹. The AI-uncovered flaws triggered a rare global cyber-security response².

The bugs were discovered this week by OpenAI models, and they have existed for more than a decade in PHP, a programming language that is 30 years old^1,4.

Why it matters to investors

The episode, which security experts have labelled Black October, is one of a series of hacks and bugs that have left them unsure what happens next³. AI is changing everything about hacking, according to coverage of the episode, and the PHP flaws are a prominent case^2,3.

OpenAI chief executive Sam Altman has said he no longer thinks it will be possible to simply patch all the bugs⁵. That statement, from the head of the company whose models found the flaws, frames the problem as continuing rather than a single event^4,5.

The exposure reaches beyond ordinary websites. Trust Wallet dismissed speculation about a potential security impact from the PHP exploit, and Binance founder Changpeng Zhao recommended that projects publish information about their exposure⁶. The response from crypto platforms shows that companies are being asked to account for their exposure to the flaws⁶. The vulnerabilities could allow hackers to steal passwords or take control of servers, which is why exposure matters to users and investors alike¹.

What to watch

The next sign will be whether any attacks using the flaws succeed before patches are complete¹. The temporary shutdowns of dozens of sites show how quickly organisations moved, but the code runs on millions of websites¹.

Disclosure is the second issue. Calls for projects to publish their exposure, as Zhao urged, would give investors a clearer view of which companies were affected⁶.

Investors will also watch whether AI models find further long-hidden flaws in widely used code, which would extend the disruption described as Black October^3,4,5.