‘Black October’: cybersecurity experts sound the alarm over new era of AI-enabled hacking | Technology | The Guardian  (cybersecurity-ai-hacking-php-vulnerability.html)   (../../../../../assets.guim.co.uk/static/frontend/manifest.json)  (https://assets.guim.co.uk/static/frontend/icons/homescreen/apple-touch-icon.svg) (https://assets.guim.co.uk/static/frontend/icons/homescreen/apple-touch-icon-512.png) (https://assets.guim.co.uk/static/frontend/icons/homescreen/apple-touch-icon-360.png) (https://assets.guim.co.uk/static/frontend/icons/homescreen/apple-touch-icon-240.png) (https://assets.guim.co.uk/static/frontend/icons/homescreen/apple-touch-icon-120.png) (../../../../../static.guim.co.uk/images/favicon-32x32.ico) (https://assets.guim.co.uk/) (https://i.guim.co.uk) (https://j.ophan.co.uk) (https://ophan.theguardian.com) (https://sourcepoint.theguardian.com) (https://assets.guim.co.uk/) (https://i.guim.co.uk) (https://j.ophan.co.uk) (https://ophan.theguardian.com) (https://api.nextgen.guardianapps.co.uk) (https://hits-secure.theguardian.com) (https://interactive.guim.co.uk) (https://static.theguardian.com) (https://support.theguardian.com) (https://assets.guim.co.uk/static/frontend/fonts/guardian-headline/noalts-not-hinted/GHGuardianHeadline-Bold.woff2) (https://assets.guim.co.uk/static/frontend/fonts/guardian-textegyptian/noalts-not-hinted/GuardianTextEgyptian-Regular.woff2)                                 (../../../../../assets.guim.co.uk/static/frontend/css/print.css)  (cybersecurity-ai-hacking-php-vulnerability.html#maincontent) Skip to main content (cybersecurity-ai-hacking-php-vulnerability.html#navigation) Skip to navigation (Close [ESC or Q])   Close dialogue  1 / 1   (Next image [→])   Next image  (Previous image [←])   Previous image  (Toggle caption [i])   Toggle caption                         (https://support.theguardian.com/subscribe/weekly?REFPVID=undefined&INTCMP=undefined&acquisitionData=%7B%22source%22%3A%22GUARDIAN_WEB%22%2C%22componentId%22%3A%22PrintSubscriptionsHeaderLink%22%2C%22componentType%22%3A%22ACQUISITIONS_HEADER%22%2C%22referrerUrl%22%3A%22%22%7D) Print subscriptions   (https://www.theguardian.com/email-newsletters) Newsletters   (https://profile.theguardian.com/signin?INTCMP=DOTCOM_NEWHEADER_SIGNIN&ABCMP=ab-sign-in&componentEventParams=componentType%3Didentityauthentication%26componentId%3Dguardian_signin_header)   Sign in        US  (https://www.theguardian.com/preference/edition/us) US edition  (https://www.theguardian.com/preference/edition/uk) UK edition  (https://www.theguardian.com/preference/edition/au) Australia edition  (https://www.theguardian.com/preference/edition/eur) Europe edition  (https://www.theguardian.com/preference/edition/int) International edition      (https://www.theguardian.com/) The Guardian - Back to home             The Guardian    (https://www.theguardian.com/) News  (https://www.theguardian.com/commentisfree) Opinion  (https://www.theguardian.com/sport) Sport  (https://www.theguardian.com/culture) Culture  (https://www.theguardian.com/lifeandstyle) Lifestyle    Show more    Hide expanded menu       News (https://www.theguardian.com/) View all News  (https://www.theguardian.com/us-news) US news  (https://www.theguardian.com/us-news/us-politics) US politics  (https://www.theguardian.com/us-news/us-midterm-elections-2026) Midterms 2026  (https://www.theguardian.com/world) World news  (https://www.theguardian.com/environment/climate-crisis) Climate crisis  (https://www.theguardian.com/world/middleeast) Middle East  (https://www.theguardian.com/world/ukraine) Ukraine  (https://www.theguardian.com/us-news/usimmigration) US immigration  (https://www.theguardian.com/us/soccer) Soccer  (https://www.theguardian.com/us/business) Business  (https://www.theguardian.com/us/environment) Environment  (https://www.theguardian.com/us/technology) Tech  (https://www.theguardian.com/science) Science  (https://www.theguardian.com/email-newsletters) Newsletters  (https://www.theguardian.com/thefilter-us) The Filter  (https://www.theguardian.com/us/wellness) Wellness      Opinion (https://www.theguardian.com/commentisfree) View all Opinion  (https://www.theguardian.com/profile/editorial) The Guardian view  (https://www.theguardian.com/us/columnists) Columnists  (https://www.theguardian.com/tone/letters) Letters  (https://www.theguardian.com/type/video+tone/comment) Opinion videos  (https://www.theguardian.com/tone/cartoons) Cartoons      Sport (https://www.theguardian.com/sport) View all Sport  (https://www.theguardian.com/us/soccer) Soccer  (https://www.theguardian.com/sport/nfl) NFL  (https://www.theguardian.com/sport/tennis) Tennis  (https://www.theguardian.com/sport/mlb) MLB  (https://www.theguardian.com/football/mls) MLS  (https://www.theguardian.com/sport/nba) NBA  (https://www.theguardian.com/sport/wnba) WNBA  (https://www.theguardian.com/sport/nhl) NHL  (https://www.theguardian.com/sport/formulaone) F1  (https://www.theguardian.com/sport/golf) Golf      Culture (https://www.theguardian.com/culture) View all Culture  (https://www.theguardian.com/film) Film  (https://www.theguardian.com/books) Books  (https://www.theguardian.com/music) Music  (https://www.theguardian.com/artanddesign) Art & design  (https://www.theguardian.com/tv-and-radio) TV & radio  (https://www.theguardian.com/stage) Stage  (https://www.theguardian.com/music/classicalmusicandopera) Classical  (https://www.theguardian.com/games) Games  (https://www.theguardian.com/artanddesign/series/design-a-better-world) Design a better world      Lifestyle (https://www.theguardian.com/lifeandstyle) View all Lifestyle  (https://www.theguardian.com/thefilter-us) The Filter  (https://www.theguardian.com/us/wellness) Wellness  (https://www.theguardian.com/fashion) Fashion  (https://www.theguardian.com/food) Food  (https://www.theguardian.com/tone/recipes) Recipes  (https://www.theguardian.com/lifeandstyle/love-and-sex) Love & sex  (https://www.theguardian.com/lifeandstyle/home-and-garden) Home & garden  (https://www.theguardian.com/lifeandstyle/health-and-wellbeing) Health & fitness  (https://www.theguardian.com/lifeandstyle/family) Family  (https://www.theguardian.com/travel) Travel  (https://www.theguardian.com/money) Money    Search input  (Search the Guardian)  google-search   Search       (www.theguardian.com)      (https://support.theguardian.com?acquisitionData=%7B%22source%22:%22GUARDIAN_WEB%22,%22componentType%22:%22ACQUISITIONS_HEADER%22,%22componentId%22:%22side_menu_support%22%7D&INTCMP=side_menu_support) Support us  (https://support.theguardian.com/subscribe/weekly?REFPVID=undefined&INTCMP=undefined&acquisitionData=%7B%22source%22%3A%22GUARDIAN_WEB%22%2C%22componentId%22%3A%22PrintSubscriptionsHeaderLink%22%2C%22componentType%22%3A%22ACQUISITIONS_HEADER%22%2C%22referrerUrl%22%3A%22%22%7D) Print subscriptions  (https://www.theguardian.com/email-newsletters) Newsletters  (https://app.adjust.com/1hskf6nd?adgroup=USHeader) Download the app   (https://theguardian.newspapers.com) Digital Archive  (https://licensing.theguardian.com/) Guardian Licensing  (https://www.theguardian.com/guardian-live-events?INTCMP=live_us_header_dropdown) Live events  (https://www.theguardian.com/about) About Us  (https://app.adjust.com/16xt6hai) The Guardian app  (https://www.theguardian.com/video) Video  (https://www.theguardian.com/podcasts) Podcasts  (https://www.theguardian.com/inpictures) Pictures  (https://www.theguardian.com/insidetheguardian) Inside the Guardian  (https://www.theguardian.com/weekly?INTCMP=gdnwb_mawns_editorial_gweekly_GW_TopNav_US) Guardian Weekly  (https://www.theguardian.com/crosswords) Crosswords  (https://www.wordiply.com) Wordiply  (https://www.theguardian.com/theguardian/series/corrections-and-clarifications) Corrections  (https://www.theguardian.com/tips) Tips    Search input  (Search the Guardian)  google-search   Search       (www.theguardian.com)   (https://theguardian.newspapers.com) Digital Archive  (https://licensing.theguardian.com/) Guardian Licensing  (https://www.theguardian.com/guardian-live-events?INTCMP=live_us_header_dropdown) Live events  (https://www.theguardian.com/about) About Us         (https://www.theguardian.com/uk-news) UK  (https://www.theguardian.com/us-news/us-politics) US politics  (https://www.theguardian.com/world) World  (https://www.theguardian.com/environment/climate-crisis) Climate crisis  (https://www.theguardian.com/world/middleeast) Middle East  (https://www.theguardian.com/world/ukraine) Ukraine  (https://www.theguardian.com/football) Football  (https://www.theguardian.com/email-newsletters) Newsletters  (https://www.theguardian.com/business) Business  (https://www.theguardian.com/environment) Environment  (https://www.theguardian.com/politics) UK politics  (https://www.theguardian.com/science) Science  (https://www.theguardian.com/technology) Tech   (https://www.theguardian.com/global-development) Global development  (https://www.theguardian.com/obituaries) Obituaries                      (A website homepage.)          The homepage of the PHP.net website on 22 October 2026 in Singapore. Photograph: Yong Teck Lim/Getty Images     (cybersecurity-ai-hacking-php-vulnerability.html#img-1)   View image in fullscreen       The homepage of the PHP.net website on 22 October 2026 in Singapore. Photograph: Yong Teck Lim/Getty Images       (https://www.theguardian.com/technology/technology) Technology     ‘Black October’: cybersecurity experts sound the alarm over new era of AI-enabled hacking   After discovery of severe bug in the PHP programming language, executives warn of ‘vulnerability tsunami’         (https://www.theguardian.com/profile/johana-bhuiyan) Johana Bhuiyan   Fri 23 Oct 2026 14.48 EDT  Last modified on Fri 23 Oct 2026 14.59 EDT   (mailto:?subject=‘Black October’: cybersecurity experts sound the alarm over new era of AI-enabled hacking&body=https://www.theguardian.com/technology/2026/oct/23/cybersecurity-ai-hacking-php-vulnerability?CMP=share_btn_url) Share          (https://www.google.com/preferences/source?q=theguardian.com) Prefer the Guardian on Google          Leaders in cybersecurity are sounding the alarm after the discovery of a major vulnerability this week. They are predicting that artificial intelligence tools will expose more fundamental weaknesses in global internet infrastructure in the months to come. “I no longer think we’re going to be able to patch all bugs,” said Sam Altman on Thursday evening, joining the chorus of executives. In the midst of what’s being called “Black October”, for which researchers used AI to help identify critical flaws in a coding language that is used across millions of websites and may have been unpatched for years, tech executives are warning about the ways AI will be used both to identify and exploit security vulnerabilities at an unprecedented scale and pace.  The next few months will see a “vulnerability tsunami”, according to Jason Clinton, Anthropic’s deputy chief information security officer. “There won’t be enough time to patch critical infrastructure,” Clinton said in a post on X on Thursday evening. Marc Benioff, the Salesforce CEO, agreed and called it a “code red”. AI is uniquely able to find and identify security flaws in a way and at a pace that will feel catastrophic because the security community will not be able to move quickly enough to address them, said Matthew Prince, the Cloudflare CEO. “It’s going to feel like the sky is falling. It’s going to feel like there’s nothing we can do. “The next two years are going to be incredibly, incredibly, incredibly fraught with new tools that have infinite patience to go look for vulnerabilities across the Internet,” he wrote in a post on X. While cybersecurity experts have been warning about a (https://community.ibm.com/community/user/blogs/eddie-roe/2026/09/09/vulnpocalypse-and-the-mainframe) “vulnpocalypse”,  or the ability for AI to more easily identify security bugs for months, it wasn’t until “Black October” that researchers were able to use AI to find a flaw as fundamental and critical as the one announced on 21 October. Massive bugs were found in a programming language called PHP, which may have left the millions of websites that run on it vulnerable to hackers for years. Some experts estimated 70% of all the sites on the internet were at risk of hacking. However, in the same way AI will be used to aid in identifying security vulnerabilities at an unprecedented pace, tech leaders worry it’ll also be used by malicious actors to exploit those bugs at an unprecedented pace. Attempts to exploit the PHP vulnerability (https://www.theguardian.com/technology/2026/oct/22/websites-across-world-hit-by-millions-of-attempts-to-exploit-php-code-flaw) have already begun . After the vulnerabilities were announced, government and private websites across the US and UK temporarily took down their sites to patch the bugs. The US National Security Agency (NSA) issued an alert recommending any site that runs on PHP implement the patches immediately. Malicious cyberactors may seek to further exploit these bugs to access servers without authorization, the NSA said. “Such an access vector could help attackers steal sensitive data, disrupt services or move deeper into a network,” (https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/) the warning read.  (cybersecurity-ai-hacking-php-vulnerability.html#EmailSignup-skip-link-11) skip past newsletter promotion     Free newsletter | Weekly    Sign up to TechScape  A weekly dive in to how technology is shaping our lives  ()   Enter your email  ()   Sign up      after newsletter promotion   In a post on X, Prince said CloudFlare, a security provider, had seen evidence of thousands of people trying to exploit the PHP flaws in the 10 hours before it was announced. “That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now,” he wrote. In a blogpost, researchers at AI security platform Wiz said that this was “among the most severe vulnerabilities discovered in PHP, and arguably in software history”. “The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” (https://www.wiz.io/blog/php2shell-php-rce) they wrote.          Explore more on these topics (https://www.theguardian.com/technology/technology) Technology  (https://www.theguardian.com/technology/artificialintelligenceai) AI (artificial intelligence)  (https://www.theguardian.com/tone/news) news    (mailto:?subject=‘Black October’: cybersecurity experts sound the alarm over new era of AI-enabled hacking&body=https://www.theguardian.com/technology/2026/oct/23/cybersecurity-ai-hacking-php-vulnerability?CMP=share_btn_url) Share     (https://syndication.theguardian.com/?url=https%3A%2F%2Fwww.theguardian.com%2Ftechnology%2F2026%2Foct%2F23%2Fcybersecurity-ai-hacking-php-vulnerability&type=article&internalpagecode=technology/2026/oct/23/cybersecurity-ai-hacking-php-vulnerability) (Reuse this content) Reuse this content                            Most viewed      Most viewed                                                               (https://www.theguardian.com/uk-news) UK  (https://www.theguardian.com/us-news/us-politics) US politics  (https://www.theguardian.com/world) World  (https://www.theguardian.com/environment/climate-crisis) Climate crisis  (https://www.theguardian.com/world/middleeast) Middle East  (https://www.theguardian.com/world/ukraine) Ukraine  (https://www.theguardian.com/football) Football  (https://www.theguardian.com/email-newsletters) Newsletters  (https://www.theguardian.com/business) Business  (https://www.theguardian.com/environment) Environment  (https://www.theguardian.com/politics) UK politics  (https://www.theguardian.com/science) Science  (https://www.theguardian.com/technology) Tech   (https://www.theguardian.com/global-development) Global development  (https://www.theguardian.com/obituaries) Obituaries       (https://www.theguardian.com/) News  (https://www.theguardian.com/commentisfree) Opinion  (https://www.theguardian.com/sport) Sport  (https://www.theguardian.com/culture) Culture  (https://www.theguardian.com/lifeandstyle) Lifestyle    Original reporting and incisive analysis, direct from the Guardian every morning (https://www.theguardian.com/info/2018/sep/17/guardian-us-morning-briefing-sign-up-to-stay-informed) Sign up for our email     (https://www.theguardian.com/info/about-guardian-us) About us  (https://manage.theguardian.com/help-centre) Help  (https://www.theguardian.com/info/complaints-and-corrections) Complaints & corrections  (https://www.theguardian.com/info/about-guardian-us/contact) Contact us  (https://www.theguardian.com/tips) Tip us off  (https://www.theguardian.com/securedrop) SecureDrop  (https://www.theguardian.com/info/privacy) Privacy policy  (https://www.theguardian.com/info/cookies) Cookie policy  (https://uploads.guim.co.uk/2026/07/22/STL_Global_Tax_Strategy_for_the_year_to_31_March_2027.pdf) Tax strategy  (https://www.theguardian.com/help/terms-of-service) Terms & conditions   (https://www.theguardian.com/index/subjects/a) All topics  (https://www.theguardian.com/index/contributors) All writers  (https://www.theguardian.com/email-newsletters?INTCMP=DOTCOM_FOOTER_NEWSLETTER_US) Newsletters  (https://theguardian.newspapers.com) Digital newspaper archive  (https://bsky.app/profile/us.theguardian.com) Bluesky  (https://www.facebook.com/theguardian) Facebook  (https://www.instagram.com/guardian) Instagram  (https://www.linkedin.com/company/theguardian) LinkedIn  (https://www.threads.com/@guardian_us) Threads  (https://www.tiktok.com/@guardian) TikTok  (https://www.youtube.com/user/TheGuardian) YouTube   (https://usadvertising.theguardian.com) Advertise with us  (https://www.theguardian.com/guardian-labs-us) Guardian Labs  (https://workwithus.theguardian.com/) Work with us  (https://www.theguardian.com/help/accessibility-help) Accessibility settings         (cybersecurity-ai-hacking-php-vulnerability.html#top) Back to top      © 2026Guardian News & Media Limited or its affiliated companies. All rights reserved.(dcr)