The era of AI cyber attacks: 'Will experience the feeling that the sky is about to fall'

"I think from now until the next few years, there will be weeks where we will experience the feeling that the sky is about to fall," Matthew Prince, CEO of Cloudflare wrote on Twitter on October 23. "The next two years will be extremely intense, as new tools have the ability to be 'infinitely patient' in finding security vulnerabilities across the entire Internet."

Many companies and governments around the world are still busy testing systems and updating patches related to the PHP programming language after two PHP2Shell vulnerabilities were made public on October 21. Both were discovered by at least three independent organizations, including startup Calif Research and OpenAI using GPT-5.6 Sol, and Google using Gemini 4 Argon to find them.

With a high level of severity, both Guardian and Business Insider called this "dark October" for cybersecurity. Meanwhile, in addition to Matthew Prince, a series of industry experts simultaneously warned that everything has not stopped.

"I don't think we can patch all the vulnerabilities anymore," OpenAI CEO Sam Altman wrote on Twitter on October 23.

According to Jason Clinton, Deputy Director of Information Security at Anthropic, in the next few months, the cybersecurity field will witness a "intense wave of security vulnerabilities".

"There will not be enough time to patch critical infrastructure vulnerabilities," Clinton wrote on Twitter on October 24. Marc Benioff, CEO of Salesforce, also agreed and called this a "red alert situation".

According to Reuters, software source code is increasingly complex, causing programming errors (bugs) to create vulnerabilities in unpredictable locations. Previously, after discovering a bug, hackers could need weeks, even months, to create an exploit. This period gives the security team more time to fix and release patches.

AI is changing that process, as models continuously review source code, find errors, and identify vulnerabilities in just a few hours. According to Shane Fry, Chief Technology Officer of RunSafe Security (USA), the effectiveness of AI in recent months shows its ability to change the cybersecurity industry.

"What is certainly changing is the time it takes to detect vulnerabilities and the speed with which adversaries can weaponize them," Fry told Reuters.

However, some experts see the problem as exaggerated. Daniel Stenberg, developer of the Curl data transmission tool, assessed that the vulnerabilities AI finds are often rare and very difficult to exploit. Ramy Rahman, an engineer at ArmorCode, also said that "discovering more vulnerabilities does not mean more successful attacks".

Solve people's own "garbage".

According to Business Insider, AI finding vulnerabilities in PHP is causing chaos globally, when a series of websites and services of many governments, organizations, businesses... proactively close down to limit the impact while updating the latest version.

"At first glance, AI looks like a villain," this page commented. "But in reality, most of this mess is man-made."

Specifically, the Internet has operated for decades based on various types of software, and many of them contain security vulnerabilities that are "ignored, forgotten or simply not fixed". For many years, this has been a controllable "gamble", because exploiting little-known security vulnerabilities is not easy and requires high expertise.

AI is changing that. A vulnerability that took someone with years of cybersecurity training to find now only requires an AI model. Suddenly, all the problems that had been ignored suddenly became more urgent.

Since the AI ​​model exploded, the number of published security vulnerabilities has also increased dramatically. According to the CVE Program, this year alone, the number of vulnerabilities found increased "steeply" from about 4,000 to more than 15,000, or more than 275%.

According to experts, at first glance AI is creating new security problems. But in fact, technology is exposing the weaknesses left by humans. "The irony is that people worry about AI causing a cybersecurity crisis, but it's old human programming errors that are the cause, and AI is cleaning them up," software engineer Ben Kaufman wrote on Twitter.

"Humans have been writing and viewing each other's code for decades," said technology founder Anant Jain. "If we're intellectually honest and set the same standards for ourselves as we do for AI, we'd probably have to admit we're not good either."

Some other experts believe that on the Internet, most resources are free, but the responsibility for protection is disproportionate. For example, PHP is the foundation of about 70% of websites and applications, but is maintained by only a small non-profit organization with only one director and staff. Tom Occhino, Product Director of Vercel, assessed this as "part of the tragedy of common resources, when everyone benefits but no one has enough motivation to take responsibility for protection".

Occhino proposed establishing an organization or coalition that would sponsor the discovery of vulnerable software and replace it with more secure solutions. Companies can contribute computing power and AI tools to this effort. "That is a more appropriate response instead of panicking at the risk of the Internet collapsing," he said. "AI is not the cause. It is humans who have allowed the situation to persist. It's time for us to clean up the mess ourselves."