AI Helped Find a Critical Bug Affecting Huge Swathes of the Internet

Researchers using new AI models, including Google's most recently released model and one from OpenAI released in July, discovered exploitable vulnerabilities in PHP that could let attackers take command of websites running WordPress and other PHP-based systems, prompting PHP developers to release fixes and government agencies in Europe and Canada to take some sites offline for updates. OpenAI called the disclosure "one of the most impactful security issues in recent memory" and said the PHP bugs are a few "among several significant vulnerabilities we've already found and are working to fix," while Epoch AI data shows critical vulnerability reports from major tech providers and open-source projects have risen from a couple dozen a month a few years ago to about 600 in a typical month. OpenAI president Greg Brockman wrote that the manual patch process will not scale as more AI-found exploits arrive and suggested governments may need to take a vastly expanded role in monitoring and even fixing vulnerable internet infrastructure.

Sign up for the free https://www.motherjones.com/newsletters/?mj oac=Article Top No Oligarchs Mother Jones Daily . Newly announced vulnerabilities could affect broad swathes of the internet after being discovered by teams of cybersecurity professionals—with heavy AI assistance. The issues affect PHP, a widely-used open-source programming language that provides a foundation for content management systems like WordPress, which powers a broad array of websites including those of the Center for Investigative Reporting . Left unpatched, the vulnerabilities could allow fast-acting attackers to take command of a website, adding malware or stealing user data. The announcement left cybersecurity teams scrambling to install fixes released by PHP’s developers, with agencies across the world issuing urgent announcements, and some government websites in Europe and Canada being taken down for updates. According to reporting from the Wall Street Journal https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea?mod=hp lead pos1 , the type of vulnerability in question was noted decades ago, “but the flaw had been considered too difficult to exploit and was largely forgotten” until August, when researchers using new models found a way to exploit it. Those included Google’s most recently released model and one from OpenAI that was released in July. OpenAI called the discovery https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/ “one of the most impactful security issues in recent memory,” but it’s part of a much broader pattern. A graph compiled by research nonprofit Epoch AI https://epoch.ai/data/cve?view=graph shows the number of significant vulnerabilities reported each month by some of the biggest tech providers and open-source projects: A few years ago, they might report a couple of dozen critical vulnerabilities in a given month—now, a typical month sees 600. OpenAI said in the same statement that the vulnerabilities announced today are only a few “among several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months.” Greg Brockman, president and second-in-command at OpenAI, wrote separately today https://x.com/gdb/status/2112921529650688312 that the process for creating fixes for the PHP bug was slow and manual in a way that would not work as more exploits are expected over the coming months. He suggested that governments may have to take a vastly expanded role in monitoring infrastructure across the internet, perhaps even stepping in to fix vulnerabilities on other servers themselves. Cybersecurity has been a key focus for AI leaders and policymakers, especially since April, when it became clear that Anthropic’s Claude Mythos Preview could autonomously discover and exploit critical software vulnerabilities. That led Anthropic to hold back on releasing the model, and it and OpenAI have worked to give trusted partners—like major companies and government agencies—access to their models in advance to harden cyberdefenses. When I spoke to experts on AI risks in August, they told me that we were probably mere months from AI being able to help with advanced cyberattacks. Much of their fear was to do with open-weight models, which can have their safeguards stripped away, and have consistently trailed the abilities of the best closed-weight models by about 6 to 12 months. The concern is that every hacker will soon have access to a model as strong as Claude Mythos, and will be able to target any institution that is slightly behind on its cybersecurity—from your local utility company to the hospital down the road. That’s still a real worry, and open-weight models could be quite helpful in exploiting vulnerabilities like those affecting PHP. But today’s news shows that open-weight models aren’t the only cause for cybersecurity concern. In addition to the PHP issue, The Information reported https://www.theinformation.com/articles/hackers-used-claude-grok-fully-automate-attacks-banks today that hackers largely automated attacks against 400 financial institutions across Latin America with help from models made by Anthropic, the Chinese company Moonshot, and Elon Musk’s company https://www.motherjones.com/politics/2026/10/elon-musk-ai-semiconductors-successionism-terafab-factory-x/ SpaceXSI formerly SpaceXAI, formerly xAI . They apparently got around some safeguards by convincing the models that they were being tested in harmless environments. Of course, it’s not just cyberspace where AI models are developing superhuman abilities. The leading models are demolishing problems that stumped top mathematicians https://www.nytimes.com/2026/10/08/science/mathematicians-respond-openai-release.html and, increasingly, physicists https://bigthink.com/starts-with-a-bang/ai-first-breakthrough-theoretical-physics/ . AI is helping to design proteins and viruses in ways that have promising medical applications https://www.nytimes.com/2026/10/20/science/ai-virus-bacteria-radical-numerics.html and could lead towards treacherous bioweapons research https://www.science.org/content/article/chilling-warning-or-overreaction-ai-bioweapons-report-divides-experts . AI is already putting us in a world with more possibilities, and more dangers. There’s a whole lot of work to do to keep up.