Software flaws found by artificial intelligence are turning up faster than security teams can fix them. CNBC on Oct. 23 labeled the moment AI’s “Black October”, after critical flaws in PHP set off a global security rush. Reuters reported that government websites went dark after the AI-discovered flaw. Chris Krebs is a former director of the Cybersecurity and Infrastructure Security Agency (CISA), and CNBC identified him as founder of The Krebs Group. He gave the network a figure: “3% of all critical vulnerabilities ever discovered have been found in the last month.”
A critical vulnerability is a software defect serious enough that an attacker could use it to take over a system, steal data or knock services offline, often without needing a password. Cloud security firm Wiz reported that AI found critical remote code execution flaws in PHP, which it named PHP2Shell, affecting 70% of the internet.
Defenders Now Face a Record Flood of Flaws
Krebs used Microsoft (NASDAQ:MSFT | MSFT Price Prediction) as his example. He said the company alone has disclosed about 2500 critical vulnerabilities in its monthly updates over the last three months. That compares with about 2000 for 2024 and 2025 combined.
“Companies are using frontier models from the labs, and they are bashing it up against proprietary code. They’re bashing it up against open source code like PHP, and they’re just having a field day popping out all these vulnerabilities,” Krebs said.
Frontier models are the most advanced AI systems built by the leading labs. Open source code is software whose source code is published so anyone can use or change it. Palo Alto Networks (NASDAQ:PANW) and its Unit 42 team published a threat brief on two critical PHP vulnerabilities, updated Oct. 23. OpenAI also posted about coordinating a global response as AI agents discover critical flaws.
Defenders Get a 6 to 9 Month Head Start at Most
“If there’s a 6 to 9 month lag before the open weight models get those frontier capabilities, that means you have a 6 to 9 month window at best to discover and patch,” Krebs said.
Open-weight models are AI models whose inner workings are released to the public, so anyone can download and run them, attackers included. In Krebs’ view, defenders hold the best tools today, and that lead will shrink. The CNBC segment noted that Anthropic’s chief information security officer has said the next 18 months are going to be brutal.
Small Businesses Carry the Most Exposure
“The real challenge and the thing I’m worried about the most is 70% of the world’s internet sites run on PHP. It’s that last mile problem where the bulk of the economy lies, where small and medium sized businesses, mom and pop shops,” Krebs said, repeating Wiz.
PHP is a programming language that runs on web servers to build dynamic web pages. The National Security Agency’s advisory warns that PHP2Shell “could allow attackers to take control of affected web servers without prior access or authentication.” Moody’s (NYSE:MCO) reported the flaws are under active exploitation, and Kaspersky reported websites being taken offline.
A Patch Can Break Critical Equipment
“If you are a small or medium sized company, if you are a rural hospital, if you are a water utility, you are scanning constantly for vulnerabilities. You’re deploying those patches as soon as you can, if you can. Not all products can be updated because you have other rickety old legacy dependencies where it could break a connection with a critical imaging machine,” Krebs said.
Per the segment, his advice is to keep a strong inventory of software and hardware, scan all the time, patch as fast as possible, and move systems offline where a patch would break older equipment. The NSA alert this week said much the same. It advised organizations that cannot update right away to take the system offline until it can be fully mitigated.
Security Costs Are Climbing for Everyone
For investors and business owners, the takeaway is more security work and higher costs across the economy. Large enterprises have dedicated staff to triage thousands of reports and roll out fixes quickly. Small firms, rural hospitals and water utilities often depend on a handful of IT workers or outside contractors, and older equipment can leave them with no clean way to patch. Those operators face the toughest choices in deciding which systems to fix, isolate or replace.
Security vendor shares have responded to AI news. On Oct. 14, 24/7 Wall St. reported that a report of OpenAI planning to buy a cybersecurity startup pushed Palo Alto shares down 4% in early trading. That raised the question of whether AI labs end up partnering with security incumbents or competing with them.
Speed Now Decides Who Stays Safe
Krebs’ message from the segment is that the flood of flaws will keep growing in the near term. In the coming weeks, watch for patch announcements from software vendors, for further exploitation reports, and for signs that open-weight models are gaining the same ability to find flaws. With a window of 6 to 9 months at best, defenders have limited time to find and patch flaws.