Big quote: Cloudflare CEO Matthew Prince says the PHP flaws that forced websites offline last week are only the beginning. His company already knows of other severe vulnerabilities in critical software, and he expects AI tools to keep turning up new ones for years. Because these models have sharply cut the time and skill needed to find and exploit serious bugs, defenders and everyday users face a long stretch of disruption before the internet’s core software ends up safer.
Prince told Reuters that Cloudflare is aware of “a bunch of additional severe vulnerabilities that are present in other pieces of critical software,” though he did not name the affected programs. He compared them to the PHP bugs that recently forced government websites, the game store GOG, and many smaller websites offline while their operators rushed to patch.
By some estimates, PHP runs on about 70% of the world’s websites, a reach that made the flaws a potential entry point into some of the internet’s most visited destinations. TechSpot has always run on PHP, for example, and we had to update our servers that same morning out of caution. We imagine something similar happened to Wikipedia, Microsoft.com and the countless sites based on WordPress, that were all affected.
Prince expects this to keep happening. “I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,” he said.
He blames large language models. Security researchers and criminals alike are using them to comb through the internet’s core software for weaknesses no one has found before. Until recently, the pace of that work depended on how many skilled people had the time and patience to read through complex code. Attackers faced the same limit when trying to turn a flaw into a working exploit.
– Matthew Prince 🌥 (@eastdakota) October 24, 2026
That limit matters much less now. A single person can point a fleet of LLM agents at a codebase, and those agents can produce in hours what used to take specialists weeks.
Wiz Research, one of the teams that found the PHP flaws with help from LLM tools, described the change in its technical write-up. “Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours,” the firm wrote. “As the time and expertise required for this work decrease, complexity may no longer provide a meaningful barrier, changing how we define what is vulnerable in practice.”
That runs counter to a long-held assumption in security: code that was hard to understand was partly protected because few people could take it apart. When models do that work, obscure, complicated code becomes as accessible as simple code.
The Electronic Frontier Foundation has put numbers on how fast this is moving. It says 3% of all software vulnerabilities ever recorded were found in October alone, and that nearly a quarter of all known security issues were discovered this year. The EFF credits frontier AI models from OpenAI, Anthropic and others with making zero-day discovery cheap in both open-source and proprietary code.
According to the EFF, several vulnerabilities serious enough to potentially break large parts of the internet were reported and patched in the last two weeks of October, many of them in the open-source software that most of the internet runs on.
According to the EFF, several vulnerabilities serious enough to potentially break large parts of the internet were reported and patched in the last two weeks of October, many of them in the open-source software that most of the internet runs on. Engineers have long accepted that widely used programs have bugs, and that more complex programs have more. What kept things manageable was the cost of finding them. Major flaws capable of disrupting the whole internet used to surface every few years, while smaller fixes happened steadily in the background.
Both Prince and the EFF expect conditions to get worse before they improve. The EFF says more systems will be breached more often, data breaches will become more likely, and some services may go down as attacks increase.
The group’s advice mostly comes down to basic security habits: it recommends keeping browsers and all applications fully updated, using a password manager with a different password for every site so one breach doesn’t expose other accounts, installing a tracker blocker such as its Privacy Badger extension, and watching out for phishing. Anyone running a blog or website should confirm that they or their hosting provider has applied the PHP fix.
The EFF is also encouraging a wider discussion of the underlying problems, including how companies that rely on open-source code should help maintain it and how large technology firms should be regulated.
Prince expects the problem to ease eventually. Every flaw that models find and developers fix leaves the software safer than before. “The reality is, we’re going to get a lot of this stuff cleaned up,” he said. The open question is how much damage happens before then.