AI Security News · 22 October 2026
A security flaw hidden in the code behind much of the web went unnoticed for over a decade. AI found it in a few weeks. Within hours of disclosure, attackers were trying to exploit it.
What happened
Researchers at the AI red-teaming firm Calif and the security company Wiz used AI models to hunt for weaknesses in PHP, the programming language behind a large share of the web. Calif found its first issue on 1 August 2026 and Wiz on 19 August (Fortune). The flaws affect PHP versions going back more than a decade (Wiz).
It was planned research, and the fix was prepared privately with the PHP team. But details leaked on social media around 20 October, and the PHP Foundation released its emergency patch on 21 October.
Attackers moved within hours. Cloudflare recorded tens of thousands of exploit attempts within 45 minutes of the news, and millions by that evening. AWS reported the flaw was being broadly exploited in the wild (Fortune). Government agencies in Finland and the Netherlands took websites offline as a precaution (Paubox).
Why it matters
AI didn’t create these bugs. They had been in the code for years. What AI changed was speed: it made the flaws much faster to find, and much faster to turn into working attacks. As Wiz put it, “what AI changed was the ability to understand the weaknesses and turn them into a working exploit.”
That speed works for defenders and attackers alike. The gap between a vulnerability becoming public and it being exploited is now measured in hours, not weeks.
What organizations should do
- Patch fast. Update PHP to the 21 October release. If you can’t patch right away, use the mitigations from your hosting or security provider.
- Know what’s running. Many organizations run PHP without realizing it, inside content management systems, plugins and vendor products. An accurate asset inventory is what makes fast patching possible.
- Govern AI-assisted security testing. If your teams use AI to test for vulnerabilities, decide who can use it, on which systems, how findings are handled, and where human review is required.
- Plan for faster attacks. Review whether your vulnerability management process can respond in hours for critical issues.
Related: AI-specific security threats are now covered by a new international standard. Read my ISO/IEC 27090 overview, and see where AI security fits in the 8 steps to build an AI governance program. Subscribe on YouTube for more AI security news.
Sources: Wiz, Fortune, Paubox. Facts as reported on 21–22 October 2026; check your vendors’ advisories for the latest guidance. General education, not legal advice.