Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began. As security teams and web admins scrambled this week to patch newly public PHP bugs, criminal hackers quickly attempted to exploit the flaws in the wild. Millions of exploitation attempts hit within hours of the vulnerabilities being published, according to analysis from Cloudflare--unsurprising given broad access to AI tools that can make it easier for attackers to quickly exploit flaws. So far, the nightmare scenario of mass victim takeovers and breaches hasn't come to pass.

'Black October': cybersecurity experts sound the alarm over new era of AI-enabled hacking After discovery of severe bug in the PHP programming language, executives warn of'vulnerability tsunami' Leaders in cybersecurity are sounding the alarm after the discovery of a major vulnerability this week. They are predicting that artificial intelligence tools will expose more fundamental weaknesses in global internet infrastructure in the months to come. "I no longer think we're going to be able to patch all bugs," said Sam Altman on Thursday evening, joining the chorus of executives. In the midst of what's being called "Black October", for which researchers used AI to help identify critical flaws in a coding language that is used across millions of websites and may have been unpatched for years, tech executives are warning about the ways AI will be used both to identify and exploit security vulnerabilities at an unprecedented scale and pace. The next few months will see a "vulnerability tsunami", according to Jason Clinton, Anthropic's deputy chief information security officer.

The UK government says it is working to actively identify and patch any potential exposure in its online services, after vulnerabilities were identified in the PHP programming language that underpins a significant number of the world's websites. Governments and some of the world's biggest companies, including Amazon, were scrambling to protect their systems on Thursday before hackers could exploit them. The flaws were first discovered by AI, after which governments and agencies urged websites to address them. Amazon was targeted in multiple attempts, which it said occurred before an embargo on the warning was lifted. It added that it was unclear how actors knew about the vulnerabilities.

What is PHP and why did it spark a global cyber-security scramble? For more than a decade, serious flaws had gone undetected in technology underpinning much of the internet. It took artificial intelligence (AI) to bring them to light and caused a global cyber-security alert. The vulnerabilities lie within a programming language called PHP, which has been used internationally since the 2000s to build websites. Governments and cyber-security agencies around the world scrambled to contain the fallout of this discovery on Wednesday, and have urged website operators to install a new emergency fix or consider taking their platforms offline.

The PHP Foundation has released a patch for the flaw but it may take time for vulnerable sites to use it to shore up their defences. The PHP Foundation has released a patch for the flaw but it may take time for vulnerable sites to use it to shore up their defences. Websites around the globe have gone dark after a serious vulnerability was found in a computer language used to build much of the world wide web. Belgian, Dutch, Finnish, French and German sites were among those that governments took down temporarily as they scrambled to patch the critical weakness in PHP, a language used by almost 70% of websites . The vulnerability in the programming language, which became public on Tuesday, sparked warnings from national security agencies in Washington and London.

Safety Net Creator Playbook Trending Now Mashable Selects Look Up Mashable's Best: E-readers, robovacs, laptops, earbuds, smart home and more Getting Technical with Mashable Gift Ideas For Everyone On Your List Say More Versus In My Bag Mashable @Home All Series OpenAI says GPT-5.6-Sol helped find the PHP flaws now shaking the internet The company also says the way the industry handles these discoveries needs to change. Chance Townsend is the General Assignments Editor at Mashable, covering tech, video games, dating apps, digital culture, and whatever else comes his way. He has a Master's in Journalism from the University of North Texas and is a proud orange cat father. His writing has also appeared in PC Mag and . OpenAI says its AI models helped uncover the critical PHP security flaws that have websites across the internet scrambling.

Trending Now Mashable Selects Look Up Mashable's Best: E-readers, robovacs, laptops, earbuds, smart home and more Getting Technical with Mashable Gift Ideas For Everyone On Your List Say More Versus In My Bag Mashable @Home Top creators, ranked Creator Playbook All Series Two serious flaws in software that powers a large share of the web leaked ahead of their fix. Now attacks have reportedly started. Chance Townsend is the General Assignments Editor at Mashable, covering tech, video games, dating apps, digital culture, and whatever else comes his way. He has a Master's in Journalism from the University of North Texas and is a proud orange cat father. His writing has also appeared in PC Mag and .

PCWorld reports that Microsoft set a record by fixing 1,416 security vulnerabilities in its October 2026 Patch Tuesday update, surpassing any previous single-month total. The update addresses 85 critical flaws, including 67 remote code execution vulnerabilities, a dangerous SharePoint elevation of privilege issue, and one actively exploited Windows Shell flaw. Windows and Office users are urged to apply these updates immediately to avoid serious cyberattacks and unauthorized system access. Yesterday was October Patch Tuesday, and Microsoft's security updates addressed 1,416 new vulnerabilities. Not only is that another record broken, but it's also the first time over 1,000 flaws were fixed in a single month.

The US has spent billions on surveillance towers, but hundreds of people have died near them. Here's how to strengthen federal oversight. We found cases of people who walked undetected through areas surveilled by advanced, AI-enabled towers and later died nearby, where their bodies remained unnoticed for weeks or months. These cases reflect systemic flaws in the virtual wall: broken towers, algorithms that failed to detect people, and agents who simply did not respond to alerts. This story is part of Dying on Camera, a collaboration between and . Each of these deaths should have raised alarms inside US Customs and Border Protection (CBP) about the flaws in the agency's surveillance network.

PCWorld reports that Google has patched 42 security vulnerabilities in Chrome, with three classified as critical risks affecting Windows, macOS, Linux, Android, and iOS users. Many of the fixes address use-after-free memory flaws, and while none have been exploited yet, the risks are serious enough to warrant immediate action. Users should update Chrome now via the About Google Chrome menu to stay protected.