Ryan King writes about the PHP cybersecurity threat that happened in October and provides a list of questions to run an exposure check on your system.
October brought a record flood of security alarms, and AI found a lot of the flaws. What happened in plain English, which ones could touch your company, and a Friday check that tells you in an afternoon.
Between January 1 and October 23, 2026, 86,292 software security flaws were made public. That is 2.2 times as many as in the same months of 2025, and more than all of 2025 put together. Over the same stretch, the U.S. government’s list of flaws attackers have been caught using grew by about a third.
Then came the week of October 19. On October 21, PHP, the code behind most websites, shipped fixes for two flaws that had sat in it for more than a decade. Wiz Research found them in August with help from AI, and wrote that one researcher did in a week what used to take a world-class team months. By that afternoon the Metropolitan Police, the Edinburgh and Oxford councils, the Dutch government’s DigiD login service and the Port of Rotterdam had taken websites offline to patch. The same week brought a poisoned AI tool, a company that vouches for websites with master keys close to all zeros, and a top-severity flaw in GitLab. The internet called it Black October.
My read: AI did not break the internet. It flooded the inbox. Twice as many flaws were announced, only a third more were used, and the risk is a security team that reads every alert in order while the few dangerous ones sit in the queue. If your board has asked whether you are exposed, the Friday check and a draft reply are near the end.
Key points include:
- List of flaws
- Stats on attacks
- Stolen passwords
Read the article, Did AI Just Break the Internet?, on RLKConsultingCo.com.