{"slug": "the-php-bug-marks-a-dangerous-new-era-for-the-internet-openais-poised-to-cash-in", "title": "The PHP bug marks a dangerous new era for the internet. OpenAI’s poised to cash in", "summary": "Researchers using AI models including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon discovered two PHP vulnerabilities, collectively named \"php2shell,\" affecting an estimated 70% of the web, and on Oct. 20 the PHP Foundation announced a critical patch within 24 hours, formally disclosed the next day by a coalition including OpenAI, Wiz and Calif. The disclosure followed reports that news of the vulnerabilities and exploit methods leaked in the days before the announcement, amid more than 20 cybersecurity incidents in October. The newsletter also reported that Anthropic could file for an IPO as soon as the next day, unveiled Duet as a rival to OpenAI's Dots and Meta's Muse, and that Barclays conducted AI-driven layoffs.", "body_md": "*Welcome to Eye on AI. Emily Forlini here, filling in for Beatrice Nolan. **In today’s issue:***\n\n- Researchers [discover](https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/) a security flaw affecting 70% of the web\n- Anthropic could file for IPO as soon as tomorrow\n- Anthropic unveils Duet, its rival to OpenAI’s Dots and Meta’s Muse\n- AI-driven layoffs at Barclay’s\n\nI’ve been covering the growing number of AI-powered hacks for months now, going back to when OpenAI’s models autonomously attacked Hugging Face in July. Ever since then there’s been a steady drumbeat of incidents, and this month the tempo of alarming cyber news picked up considerably.\n\nThere have been [more than 20](https://x.com/aisafetymemes/status/2113113711644737835?s=46) cybersecurity incidents in October, many just this week. The internet may officially be entering a new era, one in which sites are inherently less safe than they used to be. Cybersecurity paranoia is becoming table stakes for anyone who aims to conduct business online. Some are saying that the new “moat” for businesses is becoming how well they can protect their customers and IP from from AI-powered cyberattacks—not necessarily what that IP or customer base actually is.\n\nSecurity professionals have long been warning that increasingly powerful AI tools would empower bad actors to exploit bugs in code. This week, experts [told me](https://fortune.com/2026/10/21/powerful-new-ai-models-are-powering-a-growing-wave-of-cyber-attacks-experts-say/), those warnings are now coming true. AI models have become noticeably more powerful at cyber tasks in recent months. Specifically, they’re better at processing large amounts of code, and acting autonomously. Hackers are having greater success setting off AI agents on evil missions. Sometimes, many AIs work together in groups known as agent swarms. These swarms move quicker than a human could keep up with.\n\nSo what’s an organization to do in the face of these threats? The only answer is to fight back with AI, meaning to proactively “hack” your own code, finding bugs before bad actors do and then patching them before AI-armed hackers can strike. That’s exactly what happened this week in incident that has already become the poster child for the coming wave of AI-powered attacks. The incident involved a legacy programming language called PHP.\n\n## The PHP flaw heard ’round the world\n\nIn August, multiple research teams at different organizations, all of them using AI models to help them hunt for security flaws, found two vulnerabilities in PHP, which an estimated 70% of the web runs on. Those two bugs, as well as the method for exploiting them, are now collectively named “php2shell.” OpenAI’s GPT-5.6 Sol model seems to have played a key role in this discovery, although other models, including Google’s Gemini 4 Argon, seem also to have played a part.\n\nThe researchers treated the discovery as an emergency, but the public didn’t find out about it until this week, when on Oct. 20 the PHP foundation announced it would be issuing a critical patch within the next 24 hours. The following day, a coalition of companies—including OpenAI, Wiz, Calif, and more—that had been privately working on a fix formally disclosed it. For the full story on who first discovered the bug, and how the companies worked together over the past two months, check out the [story I wrote on this](https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/) earlier this week.\n\nThis would be a purely good news story about a potential crisis successfully averted except for a few inconvenient facts. One is that news of the vulnerabilities and how to exploit them seem to have leaked in the days leading up to PHP’s announcement. According to [Amazon](https://fortune.com/company/amazon-com/) Web Services, hackers started exploiting php2shell on Oct. 17, prior to the public disclosure. It’s possible they knew about the bug, which several organizations, including Amazon, had been notified about in advance. They had all agreed to a specific time—14:00 UTC on Oct. 21—when they could post about it as to not tip off the hackers early.\n\nThe other problem was the day-long window between PHP announcing that it was about to issue a patch and when it actually issued the patch, combined with the time lag that it naturally takes many companies to update their systems after the patch was issued. After the public disclosure of the exploit, the floodgates opened, and as of this writing there have been “millions” of attempts to exploit the bugs, while websites around the world built on flawed PHP code scramble to implement the patch. That work is still going on now. Luckily, the service most affected by the bug, WordPress, [reports](https://x.com/EmilyForlini/status/2113239252037259527) no issues. (Separately, *Fortune* published a [great story](https://fortune.com/2026/10/19/inside-the-33-hour-failed-boardroom-coup-to-overthrow-wordpress-founder-matt-mullenweg/) this week on a failed coup of WordPress’s founder, that’s worth a read.) Still, many governments and some private entities decided to take some web services offline to protect them from potential attacks while waiting for the patch to be implemented. This did save those sites from damage, but it also deprived people of the ability to use those services.\n\n## Turning hacks into cash\n\nFor organizations selling defensive AI cybersecurity tools, this is all very good news. That includes OpenAI. The company has been building out its Daybreak program, which is an application-only initiative that grants organizations access to its most sophisticated tools to help defend against sophisticated, AI-powered attacks.\n\nThe program is growing rapidly. Two weeks ago, OpenAI updated the Daybreak website with new numbers. The number of software flaws its participants have found swelled from 858 to 1,885. The number of patches produced went from 263 to 661. The more companies and cybersecurity professionals enroll, the more people are using OpenAI’s tools to proactively find and patch bugs in their code.\n\nThe PHP issue has raised further awareness of this program. OpenAI co-founder and president Greg Brockman gave it a boost too with an X [post](https://x.com/gdb/status/2112921529650688312) about the PHP exploit and OpenAI’s role in discovering it—a rare, lengthy post he has now pinned to the top of his profile. Brockman also [hired](https://fortune.com/2026/08/24/who-is-dali-rajic-openais-new-chief-revenue-officer/) a new chief revenue officer over the summer with a cybersecurity background, and tasked him with building out a sales team that can pitch its defensive software to companies.\n\nOpenAI is also [planning](https://fortune.com/2026/09/24/openai-launching-gpt-6-cyber-model-and-security-product-devday/) to debut a new cybersecurity-focused model this fall, as well as a first-of-its kind tool to help businesses deploy it more easily across their infrastructure. The company seems to have made a proactive bet on AI-powered cybersecurity tools being a burgeoning source of revenue, and that prediction is coming true. And they’re far from the only ones in this business; Anthropic has a similar program for cybersecurity professionals at vetted organizations called Project Glasswing, and multiple other SaaS providers offer AI-powered cyber defense tools.\n\nThey could be looking at some serious cash if the trend continues—and as long as the hackers don’t get to them first.\n\nWith that, here’s more AI news.\n\n**Emily Forlini**[emily.forlini@fortune.com](mailto:emily.forlini@fortune.com)[@emilyforlini](https://x.com/EmilyForlini)\n\n### FORTUNE ON AI\n\n[AI tools discovered the PHP vulnerability that could take down 70% of the internet. Now, the race is on to patch it before AI-powered hackers attack](https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/)—*by Emily Forlini*\n\n[Exclusive: AI code-testing startup Blacksmith hits $1 billion valuation as AI-written code surges](https://fortune.com/2026/10/21/exclusive-ai-code-testing-startup-blacksmith-hits-1-billion-valuation-as-ai-written-code-surges/)—*by Beatrice Nolan*\n\n[Anthropic adds Harvard astrophysicist to the trust that controls its board](https://fortune.com/2026/10/21/anthropic-adds-harvard-astrophysicist-to-the-trust-that-controls-its-board/)—*by Jeremy Kahn*\n\n### AI IN THE NEWS\n\n**Anthropic could make its IPO prospectus public as soon as tomorrow.** The public may finally get answers to many outstanding questions about Anthropic's business and its finances when the company makes public the prospectus for its planned IPO, a move that could come as soon as tomorrow, according to three people familiar the company's plans who [spoke to Yahoo! Finance](https://finance.yahoo.com/markets/article/anthropic-to-publicly-file-for-ipo-as-early-as-friday-sources-say-135343841.html). Anthropic's public stock offering could be the largest in history, valuing the Claude maker at more than $2 trillion. \n\n**Anthropic unveils its Duet personal agent.** It's the company's answer to personal assistant AI agents such as Instinct, Meta's Muse, and OpenAI's Dots, but it's only available now as a preview. Read more [here](https://www.engadget.com/2293646/claude-duet-is-anthropics-answer-to-meta-muse-and-openai-dots/) from Engadget. \n\n**Microsoft discloses 'hundreds' of autonomous AI-powered hack by China state-aligned actor.** The hacking group, known as Storm-0940, used an open-source AI platform called Artex, developed in China. That's the same technology behind a [hack](https://www.wsj.com/world/asia/hackers-use-chinese-ai-tool-to-hit-south-korean-banks-exposing-new-risk-5d4d3885) of South Korean banks earlier this month. Read more [here](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/) on the Microsoft blog.\n\n**Barclays to cut 5,000 jobs in AI-driven push to lower costs****.** The layoffs will affect 5% of the company's workforce, and come after reporting a 12% increase in quarterly profit, falling short of analyst forecasts. Is AI the savior to help the company do more with fewer employees? Read more [here](https://www.nytimes.com/2026/10/22/business/barclays-job-cuts-ai.html) in *The New York Times*.\n\n### EYE ON AI NUMBERS\n\n## 10%\n\nThat's how much of the internal traffic to OpenAI's Codex coding tool went unmonitored for months this spring due to gaps in OpenAI's internal safety and monitoring procedures, according to AI safety firms Redwood Research and METR. The firms were embedded at OpenAI for three weeks from July 21 to Aug. 11, during which they performed an independent audit of OpenAI's security posture. They found that from May to July OpenAI's Codex agent traffic was unmonitored, creating a \"coverage gap that agents could have exploited to misbehave without being caught.\" These are the same months leading up to and during the Hugging Face cyber incident, although the [report](https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/) does not say the lack of monitoring played a role in that case. METR and Redwood also found numerous other gaps in OpenAI's monitoring systems. \n\n### AI CALENDAR\n\n**Nov. 9-12:** Web Summit, Lisbon, Portugal.\n\n**Nov. 16-17:** Fortune 500 Innovation Forum, Detroit. Apply [here](https://conferences.fortune.com/event/fortune-500-innovation-forum-2026/HOME) to attend.\n\n**Nov. 18-19:** Slush, Helsinki, Finland.\n\n**Dec. 6-12:** Neural Information Processing Systems (Neurips) conference. Sydney, Australia.\n\n**Dec. 7-8:** Fortune Brainstorm AI, San Francisco. Apply [here](https://conferences.fortune.com/event/brainstorm-ai-2026/HOME) to attend.\n\nNearly half of all Americans wear a fitness tracker, up from just 13% a decade ago. But while early wearables just counted steps, connected fitness giants like Oura and Tonal are using artificial intelligence to predict your recovery before you even feel it. *Fortune* senior writer Allie Garfinkle goes inside the $2 trillion wellness economy to test the tech, analyze the multi-billion-dollar data moats, and ask a fundamental question: Is hyper-optimization making us peak performers, or just more anxious? [Watch the video here.](https://fortune.com/topic/aiq/?v=SM900009006-900009006-14497) \n\n*breaks the traditional barrier between audience and newsroom. The show transforms*\n\n**Fortune Daily**\n*Fortune*’s trusted reporting into actionable, conversational, and entertaining insights for an emerging class of business leaders.\n\n**Watch here.**", "url": "https://wpnews.pro/news/the-php-bug-marks-a-dangerous-new-era-for-the-internet-openais-poised-to-cash-in", "canonical_source": "https://fortune.com/2026/10/22/php-security-flaw-ai-powered-attacks-hackers-openai-daybreak/", "published_at": "2026-10-22 18:37:08+00:00", "updated_at": "2026-10-22 19:12:01.792162+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "ai-agents", "ai-startups"], "entities": ["OpenAI", "PHP Foundation", "GPT-5.6 Sol", "Google", "Gemini 4 Argon", "Wiz", "Calif", "Anthropic"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/the-php-bug-marks-a-dangerous-new-era-for-the-internet-openais-poised-to-cash-in", "markdown": "https://wpnews.pro/news/the-php-bug-marks-a-dangerous-new-era-for-the-internet-openais-poised-to-cash-in.md", "text": "https://wpnews.pro/news/the-php-bug-marks-a-dangerous-new-era-for-the-internet-openais-poised-to-cash-in.txt", "jsonld": "https://wpnews.pro/news/the-php-bug-marks-a-dangerous-new-era-for-the-internet-openais-poised-to-cash-in.jsonld"}}