Great quote: Cloudflare CEO Matthew Prince says the PHP bugs that caused websites to go offline last week are just the beginning. His company is already aware of other serious vulnerabilities in critical software and he assumes that AI tools will continue to uncover new vulnerabilities for years to come. Because these models have significantly reduced the time and skill required to find and exploit serious flaws, defenders and everyday users face long disruptions before the Internet’s core software becomes more secure.
Prince told Reuters that Cloudflare was aware of “a number of additional serious vulnerabilities in other parts of critical software,” but did not name the affected programs. He compared them to the PHP bugs that recently forced government websites, gaming store GOG and many smaller sites offline while their operators rushed to install patches.
PHP is estimated to run on about 70% of websites worldwide, a reach that made the vulnerabilities a potential entry point into some of the most trafficked destinations on the Internet. TechSpot, for example, has always run on PHP and out of an abundance of caution we had to update our servers that same morning. We suspect something similar happened to Wikipedia, Microsoft.com, and the countless WordPress-based websites that were all affected.
Prince expects this to continue to happen. “I think we’re going to have a few years where it’s going to be like the sky is falling every week,” he said.
He blames large language models. Security researchers and criminals alike use them to scan the Internet’s core software for vulnerabilities that no one has discovered before. Until recently, the pace of this work depended on how many professionals had the time and patience to read through complex code. Attackers faced the same limitations when trying to turn a vulnerability into a working exploit.
— Matthew Prince 🌥 (@eastdakota) October 24, 2026
This limit is now much less important. A single person can direct a fleet of LLM agents to a code base, and those agents can produce in hours what once took specialists weeks.
Wiz Research, one of the teams that found the PHP vulnerabilities using LLM tools, described the change in its technical article. “Frontier models were critical to making this process practical and allowing us to develop and customize working exploits for multiple applications in hours,” the company wrote. “As the time and expertise required to do this work decreases, complexity may no longer be a meaningful barrier and is changing the way we define what is vulnerable in practice.”
This contradicts a long-held assumption in security: code that was difficult to understand was partially protected because few people could pick it apart. When models do this work, unclear, complicated code becomes just as accessible as simple code.
The Electronic Frontier Foundation has provided numbers on how quickly this is evolving. It says that 3% of all software vulnerabilities ever recorded were discovered in October alone and that almost a quarter of all known vulnerabilities were discovered this year. The EFF credits leading-edge AI models from OpenAI, Anthropic and others with making zero-day discovery cost-effective in both open source and proprietary code.
According to the EFF, several vulnerabilities serious enough to potentially damage large portions of the Internet were reported and fixed in the last two weeks of October, many of them in the open source software that runs most of the Internet.
According to the EFF, several vulnerabilities serious enough to potentially damage large portions of the Internet were reported and fixed in the last two weeks of October, many of them in the open source software that runs most of the Internet. Engineers have long accepted that widely used programs have bugs and that more complex programs have more bugs. What kept things manageable was the cost of finding them. Major bugs that could bring down the entire Internet used to appear every few years, while smaller fixes were constantly happening in the background.
Both Prince and the EFF expect conditions to get worse before they get better. The EFF expects that more systems will be attacked more frequently, data breaches will become more likely and some services may fail as attacks increase.
The group’s advice is mostly limited to basic security habits: It recommends keeping browsers and all applications fully up to date, using a password manager with a different password for each website so that a breach doesn’t expose other accounts, installing a tracker blocker like the Privacy Badger extension, and watching out for phishing. Anyone running a blog or website should confirm that they or their hosting provider has applied the PHP fix.
The EFF is also encouraging a broader discussion of the underlying issues, including how companies that rely on open source code should help maintain it and how large technology companies should be regulated.
Prince expects the problem to ease eventually. Every bug that models find and developers fix makes the software more secure than before. “The reality is we’re going to clean up a lot of these things,” he said. The open question is how much damage will be caused by then.
