Cybersecurity researchers used AI tools to discover critical vulnerabilities in PHP, a programming language underpinning an estimated 70% of websites globally. The flaws, present for years and potentially decades, were of such complexity that researchers at Wiz called them 'at the edge of what human researchers could practically achieve.' The discovery, announced 21 October, has been dubbed 'Black October' and is being treated as an inflection point in the relationship between AI and infrastructure security. The speed of exploitation is the story within the story. Cloudflare CEO Matthew Prince reported thousands of exploitation attempts in the 10 hours before public announcement, scaling to tens of thousands within 45 minutes of disclosure, hundreds of thousands within two hours, and millions shortly after. The US National Security Agency issued an alert urging immediate patching, warning that 'malicious cyberactors may seek to further exploit these bugs to access servers without authorization.' Government and private websites across the US and UK temporarily went offline to apply fixes. The vulnerability itself was severe enough, but industry leaders are framing it as the opening salvo of a structural shift. Anthropic's deputy CISO Jason Clinton predicted a 'vulnerability tsunami' in the months ahead, warning there 'won't be enough time to patch critical infrastructure.' Cloudflare's Prince said AI tools possess 'infinite patience to go look for vulnerabilities across the Internet' and forecast two years of intensifying discovery. Salesforce CEO Marc Benioff called it a 'code red.' Sam Altman weighed in with a blunter assessment: 'I no longer think we're going to be able to patch all bugs.' This is a notable concession from the CEO of the company most aggressively deploying general-purpose AI. The implication is that the volume of discoverable flaws in legacy codebases will outstrip the capacity of human security teams to triage and remediate them, even with AI assistance on the defensive side. The core asymmetry is clear. Offensive AI needs to find one exploitable flaw. Defensive teams need to find and patch all of them, across codebases written over decades in languages never designed for this threat model. PHP alone powers millions of sites. The IBM cybersecurity community had been warning about a 'vulnpocalypse' for months before Black October validated their concerns at scale. The structural question is whether the current patch-and-respond model of internet security can survive contact with AI-augmented offensive capability. Legacy code — PHP, C, older infrastructure — was written in an era where the complexity barrier served as de facto security. AI removes that barrier. The companies sounding the alarm are also the companies selling the tools and the defenses, which creates an obvious incentive layer, but the PHP vulnerability itself is real, the exploitation data is real, and the NSA's response suggests governments agree the threat model has changed. What emerges is a landscape where AI creates genuine new capability for both sides but where the attacker's advantage is structural. Finding bugs is parallelizable; patching legacy systems is not. The security industry will grow, governments will issue more alerts, and the cost of maintaining internet infrastructure will rise. The question is whether the transition period produces catastrophic breaches or merely expensive ones.
