news-tldr.com

The important facts, the open questions, and the sources — without the churn.

← Latest briefing

Technology

Experts warn AI-enabled hacking may outpace patching of PHP flaws

The Guardian reports that tech executives warn AI tools are accelerating the search for flaws, after serious PHP bugs may have left millions of websites exposed for years.

Updated Oct 23, 2026 · 20:14 UTC1 reports

The short version

  • The Guardian reports massive PHP bugs may have left millions of websites vulnerable to hackers for years.[The Guardian]
  • The US National Security Agency urged any site running PHP to apply patches immediately.[The Guardian]
  • Cloudflare said exploit attempts rose from thousands to millions after the flaws were announced.[The Guardian]
  • Sam Altman says he no longer thinks all bugs can be patched, and Jason Clinton warns there will not be enough time to patch critical infrastructure.[The Guardian]

Key facts

  • Massive bugs were found in PHP, which may have left millions of websites that run on it vulnerable to hackers for years.[The Guardian]
  • The US National Security Agency issued an alert recommending that any site running PHP implement patches immediately.[The Guardian]
  • Cloudflare said it saw attempts to exploit the PHP flaws rise from thousands before the announcement to millions afterward.[The Guardian]
  • Sam Altman said on Thursday evening that he no longer thinks all bugs can be patched.[The Guardian]
  • Jason Clinton, Anthropic's deputy chief information security officer, predicted a coming wave of vulnerabilities and said there will not be enough time to patch critical infrastructure.[The Guardian]
  • Salesforce CEO Marc Benioff agreed with the warnings and called the situation a 'code red'.[The Guardian]
  • Some experts estimated that 70% of all sites on the internet were at risk of hacking.[The Guardian]

What remains uncertain

  • The 70% at-risk figure is attributed to unnamed experts, and the available reporting does not identify how it was calculated.[The Guardian]
  • Warnings that patching cannot keep pace with AI-driven flaw discovery are executive predictions and have not been tested.[The Guardian]
  • Cloudflare's exploit-attempt figures were shared in a post on X, and the reporting does not include independent verification of them.[The Guardian]

Sources

Outlet counts describe coverage, not independent confirmation. Reports may share a wire service or original source.