This morning, we reported on PHP2Shell, a massive security vulnerability that threatened a huge portion of the internet. Government websites were taken offline, security agencies issued emergency warnings, and businesses around the world scrambled to patch systems that could potentially be taken over by hackers without so much as a stolen password.
By this afternoon, the news had gotten considerably worse.
We learned more about how artificial intelligence helped discover the vulnerabilities, how long some of these weaknesses had been sitting inside software used by millions of websites, and how the same technology could soon make finding and exploiting these security holes easier than ever.
Then came the reports about other security disasters. A trusted certificate authority had been using dangerously weak encryption keys. A cloud database provider confirmed that attackers had accessed internal systems and stolen information. Hackers were exploiting vulnerabilities in home media servers, while another attack involved stolen credentials used to install backdoors on WordPress websites.
And perhaps the most disturbing development came from OpenAI itself. The company acknowledged that its researchers have already discovered several more significant security vulnerabilities that are still being addressed, and that it expects the number of these discoveries to increase sharply over the coming months.
We’ve been warning about the danger of AI-powered cyberattacks for months. We’ve specifically warned about what happens when these systems are turned against our banking infrastructure, communications networks, power grids, water systems, and the digital services that modern society can no longer function without.
What happened today is another warning that those concerns aren’t some far-off science-fiction scenario. The tools are already here, the vulnerabilities are real, and we’re watching the time between discovering a security hole and seeing someone attempt to exploit it shrink dramatically.
At some point, our luck is going to run out.
Today’s PHP Disaster Shows How AI Could Help Bring Everything Down
PHP isn’t something most Americans have ever heard of, but it’s one of the technologies holding the internet together. It’s used to run websites, process requests, communicate with databases, and power applications that businesses and government agencies rely on every day.
WordPress, Drupal, Joomla, and countless other platforms depend on it. The language is used by roughly 70% of websites whose server-side programming language can be identified, although that doesn’t mean every one of those websites was necessarily exploitable.
On October 21, researchers publicly disclosed two critical PHP vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Depending on the system, attackers could potentially exploit them to execute malicious code remotely, access sensitive information, or disrupt services.
The weaknesses affected PHP versions going back more than a decade, and some of the underlying code was considerably older.
Security researchers at Wiz demonstrated how attackers could exploit vulnerable configurations running major platforms, including WordPress and Drupal. The flaws were in PHP itself rather than in one particular website plugin, making the problem far more serious than an ordinary WordPress security alert.
The vulnerabilities earned a severity rating as high as 9.2 out of 10.
Governments responded by taking vulnerable websites offline while emergency updates were prepared. Security agencies urged immediate action, warning organizations unable to patch their systems to consider temporarily disconnecting affected services.
What makes this especially troubling is that the software wasn’t recently compromised by some new malicious update. The weaknesses had been sitting there for years, in code that developers and security researchers had examined countless times.
Reuters also reported that one of the underlying problems had been identified in a more limited form in 2024, but its full potential for exploitation had not been recognized. The PHP Foundation acknowledged that its handling of that earlier report represented a failure.
Think about that for a minute. A potentially catastrophic flaw in one of the internet’s most widely used programming languages existed for years, and even an earlier warning wasn’t enough to get it fixed.
The software didn’t suddenly become vulnerable this week. We finally developed better tools to understand just how vulnerable it had been all along.
Artificial Intelligence Just Changed the Rules of Cyberwarfare
The PHP2Shell vulnerabilities were discovered independently by security researchers working with advanced AI systems.
A cybersecurity company called Calif identified a critical flaw using OpenAI’s GPT-5.6 Sol model through an initiative called Patch the Planet. Researchers at Google’s Wiz also independently identified the vulnerabilities using a combination of tools that included Google’s Gemini 4 Argon and OpenAI’s model.
According to Wiz, AI allowed one researcher to accomplish in approximately a week what previously could have required months of work by an elite security team.
This is the part of the story that should worry everyone.
For decades, finding and exploiting complicated software vulnerabilities required specialized knowledge, expensive equipment, and enormous amounts of time. Skilled hackers have always existed, as have criminal organizations and foreign intelligence agencies capable of discovering serious weaknesses.
But those technical barriers limited the number of people who could realistically develop sophisticated attacks.
AI is beginning to tear down those barriers.
We’re entering a period when a single researcher, assisted by powerful models and automated testing tools, may be able to examine enormous amounts of computer code, recognize obscure weaknesses, develop ways to exploit them, and repeat the process across entirely different systems.
Right now, much of this work is being performed by legitimate security researchers who are trying to find vulnerabilities before criminals do. That’s obviously a good thing. But pretending these capabilities will remain exclusive to responsible researchers would be dangerously naive.
Criminal hackers can use AI, too. So can foreign governments, terrorist organizations, ransomware gangs, and anyone else willing to use technology to disrupt systems or steal money.
The same methods that help a researcher identify a vulnerability can also help an attacker study security patches, search for related weaknesses, and develop working exploits.
And unlike the relatively small number of experts who could perform these tasks in the past, automated tools can potentially be deployed against huge numbers of targets simultaneously.
We’re not just making hackers more capable. We’re making sophisticated capabilities easier to obtain and cheaper to use.
OpenAI Is Already Finding More Vulnerabilities Than Anyone Can Comfortably Ignore
On October 21, OpenAI published a statement discussing its involvement in the PHP2Shell discovery and the broader effort to identify vulnerabilities in widely used software.
Buried in that announcement was an admission that deserves far more attention than it’s getting.
The company acknowledged that the PHP vulnerabilities were among several significant security issues already discovered and still being addressed. It also said it expects findings of this kind to increase sharply in the coming months.
That means PHP2Shell isn’t necessarily the biggest vulnerability AI researchers have found. It’s one of the serious problems that has made it through the complicated process of investigation, patch development, coordination, and public disclosure.
OpenAI’s earlier Patch the Planet announcement provided a glimpse of what these systems are already uncovering.
Researchers working with AI-assisted security tools identified hundreds of potential issues across major open-source projects, with many requiring further investigation. Their work included vulnerabilities affecting operating systems, internet infrastructure, and popular web browsers.
Some of the reported findings are remarkable.
Researchers identified eight proof-of-concept kernel information leaks and 24 local privilege-escalation exploits involving Linux, the operating system that powers a substantial portion of the world’s servers. They found a 23-year-old vulnerability in OpenBSD and confirmed dozens of vulnerabilities in FreeBSD.
Their browser research turned up five exploitable vulnerabilities in Google’s Chrome V8 engine and more than ten exploitable Safari vulnerabilities during approximately one week of focused work.
Another discovery, dubbed HTTP/2 Bomb, involved a denial-of-service attack affecting major web server implementations. Researchers estimated that more than 880,000 internet-facing websites were running potentially affected software with the relevant protocol enabled.
These weren’t all theoretical warnings about what AI might accomplish someday. They were findings produced by researchers using AI systems that already exist.
Not every potential issue becomes an exploitable vulnerability, and human researchers still have to verify findings and help develop reliable fixes. But the volume of discoveries raises a question that nobody has a particularly comforting answer to.
What happens when the number of serious vulnerabilities being discovered begins to exceed the ability of developers, hosting companies, government agencies, and ordinary businesses to investigate and repair them?
We may be getting our first real look at that problem.
The Window Between Discovery and Attack Is Collapsing
Cybersecurity has always been a race between researchers trying to fix vulnerabilities and hackers looking to exploit them. In the past, defenders at least had some breathing room to investigate security holes, develop patches, and get those updates installed before widespread attacks began. That system was never perfect, but AI is making an already difficult job exponentially harder by allowing vulnerabilities to be discovered and exploited at speeds that traditional security teams simply cannot match.
PHP2Shell is a perfect example of how dangerous this is becoming. Details of the actual exploits were reportedly published roughly 14 hours before the patches were released, effectively handing hackers instructions for attacking vulnerable systems before administrators had a fix available. Cloudflare was already detecting malicious activity as the industry scrambled to respond, and while the company deployed emergency protections, those measures couldn’t replace installing the actual security updates.
The bigger problem is that releasing a patch doesn’t mean the danger disappears. Millions of websites run on old servers, outdated software, and neglected infrastructure that nobody regularly maintains. Some businesses don’t even know what versions of PHP their systems are running, while others depend on applications so old that administrators are afraid updating them will break everything. Many of these systems will likely remain vulnerable for months or years, and some may never be patched at all.
Meanwhile, AI is making it easier to identify which servers remain vulnerable, develop working exploits, and automate attacks against enormous numbers of targets. The hackers don’t need every website to be vulnerable. They only need to find the thousands of organizations that failed to install the update, don’t have the technical resources to respond, or aren’t even aware there’s a problem.
That’s what makes this so dangerous. We’re building tools that can find and exploit security holes faster than ever, while much of the infrastructure we depend on is still running outdated software maintained by overstretched IT departments, underfunded government agencies, and third-party providers. Eventually, the gap between discovering a critical vulnerability and exploiting it could become so small that defenders simply won’t have time to respond before serious damage is done.
PHP2Shell Wasn’t the Only Security Disaster This Week
While much of the technology industry was focused on PHP2Shell, several other major security incidents were unfolding.
These weren’t all connected attacks, and they didn’t all involve artificial intelligence. That’s precisely why they’re worth examining together. The vulnerabilities exist across different technologies, different industries, and different layers of the digital infrastructure.
The Companies Responsible for Internet Trust Were Using Weak Encryption Keys
On October 20, Google’s Chrome security team disclosed that eight intermediate certificate authority keys associated with India’s eMudhra had been compromised because they were generated using insufficient randomness.
Certificate authorities are part of the system browsers and other applications use to establish whether the encrypted website they’re connecting to can be trusted.
When you visit your bank’s website, pay a bill, or log into an online account, that system helps establish that you’re communicating with the legitimate service rather than an impostor.
The affected eMudhra private keys were insufficiently secure, creating a risk that attackers could forge trusted HTTPS certificates and impersonate websites to systems that still trusted those compromised authorities.
Google moved to block the affected certificates, and other platform providers took protective action.
There has been no confirmed public evidence that attackers successfully used those keys to impersonate websites before the problem was discovered. Nevertheless, the incident exposed a major weakness in an infrastructure that depends on trusted cryptographic credentials being generated and protected correctly.
This wasn’t a mysterious new hacking technique that nobody could have anticipated. It was a failure involving one of the most basic requirements of modern encryption: generating unpredictable private keys.
And we’re supposed to trust this entire system with banking transactions, medical records, business communications, and virtually every other important part of our digital lives.
Hackers Spent Weeks Inside a Cloud Database Company’s Systems
Cloud database provider PingCAP also disclosed a serious security incident involving unauthorized access to internal cloud resources.
According to the company’s investigation, an attacker used stolen service-account credentials to access certain internal systems between September 9 and October 7, copying data and obtaining source code before the activity was discovered.
The exposed records included some customer account information, organization and project details, billing information, SQL editor content, and encrypted API-key values.
A group calling itself FulcrumSec claimed responsibility and alleged that it had stolen approximately 10.6 terabytes of information. That figure has not been independently verified, and the company’s published findings do not establish that the attackers accessed customer databases directly.
PingCAP said its investigation found no evidence that data stored inside TiDB databases had been impacted. However, the company confirmed unauthorized access and data exposure, and advised customers to rotate affected management API keys as a precaution.
The point here isn’t whether every claim made by the attackers turns out to be accurate.
It’s that an organization responsible for cloud database technology confirmed that stolen credentials allowed an attacker into internal systems for an extended period.
Businesses routinely place enormous amounts of sensitive information in cloud services because they’re told that major technology providers have the expertise and security resources to protect it.
Sometimes those systems are compromised anyway.
And when they are, the damage can extend far beyond the company that was originally attacked.
Plex Media Servers Were Hijacked Almost Immediately After Exploit Details Became Public
Another set of vulnerabilities, collectively called Plex2Shell, affected Plex Media Server software, which many people use to stream their personal movie and television collections.
The four vulnerabilities could be chained together to allow attackers to execute code on exposed servers without valid login credentials.
Researchers disclosed technical details and proof-of-concept code, and security analysts reported attackers exploiting vulnerable installations approximately a day later.
The attackers were deploying cryptocurrency-mining software and proxy tools that could allow compromised servers to relay other internet traffic.
Plex had addressed the vulnerabilities in an earlier security update, but systems that weren’t updated remained exposed.
Consider what that means for someone who assumes cybersecurity is only a concern for banks and large corporations.
A personal media server sitting in someone’s house can become a tool used by criminals, potentially consuming electricity, using internet bandwidth, and giving an attacker another system to exploit.
The attacker’s target doesn’t have to be important. Sometimes they just need a machine that’s connected to the internet and hasn’t been patched.
Stolen WordPress Management Keys Were Used to Install Backdoors
WordPress website owners had another problem to deal with this week after TeamUpdraft, the company behind popular WordPress backup and management tools, reported unauthorized access to its systems.
The incident involved credentials associated with UpdraftCentral, a service that allows administrators to manage connected WordPress websites remotely.
According to reporting from BleepingComputer, attackers obtained connection keys and used them to install malicious backdoors on some websites.
This is particularly concerning because a remote management service is supposed to make website administration easier and more secure. When the service or its credentials are compromised, those same management capabilities can give criminals a way into multiple websites.
A WordPress owner could have reasonably current website software and still face danger if an authorized management connection had been compromised.
Node.js Issued Another Round of Security Updates
On the same day as the PHP2Shell emergency, the Node.js project issued new security releases addressing vulnerabilities in supported versions of its widely used JavaScript runtime.
The affected issues included problems involving TLS certificate handling, DNS input validation, and application permission controls, with some classified as high severity.
Node.js runs applications and online services across the internet, so keeping these systems updated is another responsibility for administrators already dealing with an endless stream of security warnings.
These are separate issues, not evidence of one coordinated attack. But together they demonstrate how many different components of the internet can require urgent security attention at the same time.
We’ve Been Warning About AI Attacks on Banks, Power, Water, and Communications
Anyone who’s followed OFFGRID Survival knows this isn’t the first time we’ve raised the alarm about what AI could do to the infrastructure Americans depend on.
Back in April, we warned about AI cyber tools and the possibility of devastating attacks against banking, critical infrastructure, and communications.
Earlier this month, we covered warnings from AI insiders who expected attacks on financial institutions, power systems, or water infrastructure within the next twelve months.
We’ve also examined reports about AI agents operating beyond their intended boundaries and concerns that increasingly autonomous systems could create new forms of cyber risk.
Those earlier reports raised different concerns, and some involved allegations or predictions rather than confirmed large-scale attacks. But the central warning has been consistent.
We’re handing more of our essential infrastructure over to interconnected digital systems at the same time we’re developing increasingly powerful tools capable of probing those systems for weaknesses.
And we’re doing it without anything resembling a reliable fallback plan for much of the population.
Consider how much of your daily life depends on networks and computers you don’t own, don’t control, and probably couldn’t repair if your life depended on it.
Your bank account exists as entries in a computer system. Your debit and credit cards depend on financial networks and payment processors. Pharmacies use electronic prescription systems. Hospitals depend on networked records, scheduling, laboratory services, and equipment. Grocery stores rely on digital inventory management, refrigerated distribution networks, electronic payments, and logistics software.
Electric utilities use computerized control systems to monitor portions of the grid. Water providers use digital systems for treatment, monitoring, and distribution. Emergency responders depend on radio networks, dispatch systems, and other communication infrastructure.
Not all of these systems are exposed to the public internet, and a vulnerability in PHP doesn’t automatically mean someone can shut down a power station or take control of a water treatment plant.
But there are connections, dependencies, remote-access services, vendors, and administrative systems that can provide opportunities for attacks or cause disruption when they fail.
An attack doesn’t have to directly compromise a power grid to create a serious emergency. Taking down a critical service provider, disrupting a utility’s administrative systems, or crippling the communications needed to coordinate a response can create problems of its own.
The more interconnected these systems become, the more opportunities exist for one failure to affect services that initially appear unrelated.
And the people responsible for keeping everything running are now being forced to defend against tools that are becoming more capable at a frightening pace.
We Are Building a Society That Cannot Survive Without Technology We Cannot Fully Protect
What worries me most isn’t simply that hackers are getting better tools. It’s that we’ve spent decades making nearly every part of our lives dependent on systems we don’t control and cannot fully protect. Banks have closed branches and pushed customers toward online banking, businesses have moved their operations into the cloud, stores increasingly depend on electronic payments, and hospitals, pharmacies, and government agencies now rely on interconnected networks for essential services. We’ve systematically eliminated many of the alternatives, all in the name of efficiency and convenience.
The problem is that efficiency doesn’t mean security, and convenience means absolutely nothing when the systems you depend on stop working. A pharmacy that can’t access its prescription database may struggle to fill medications. A business that relies entirely on cloud services may be unable to operate when its provider goes down. Families who keep everything from financial records to important documents online could suddenly find themselves locked out of information they desperately need.
And instead of addressing these vulnerabilities, we’re piling on even more technology. Artificial intelligence is being integrated into banking, healthcare, government services, industrial systems, and virtually every other industry. The companies selling this technology promise faster operations, lower costs, and greater productivity, but there’s considerably less discussion about what happens when something goes catastrophically wrong.
We already got a preview during the 2024 CrowdStrike outage, when a faulty software update caused widespread disruptions to airlines, hospitals, businesses, and other organizations around the world. That wasn’t even a cyberattack. It was a software mistake that demonstrated how a single failure at one company could cripple operations across multiple industries.
Now imagine a deliberate attack carried out by criminals using AI to identify and exploit vulnerabilities across thousands of systems before anyone has time to respond. We don’t need every computer in America to fail simultaneously for this to become a national emergency. Compromising the right financial network, cloud provider, telecommunications company, or infrastructure service could create enormous problems for everyone who depends on it.
The Next Major Cyberattack May Not Give Us Any Warning
That’s what makes this week’s PHP2Shell disaster so concerning. Legitimate security researchers discovered the vulnerabilities and attempted to coordinate fixes before criminals could exploit them. Even with that head start, details leaked before the patches were released, governments took websites offline, and attackers began probing vulnerable systems while administrators scrambled to protect their networks.
Now consider what happens when the next major vulnerability is discovered by criminals who have absolutely no intention of reporting it. AI-powered tools could allow attackers to identify weaknesses, develop exploits, and search for thousands of vulnerable systems before the companies responsible for maintaining them even realize there’s a problem. And unlike legitimate researchers, these criminals aren’t going to give anyone advance warning or wait for a security patch.
None of this requires some science-fiction scenario where AI becomes conscious and decides to destroy humanity. It simply requires giving increasingly powerful tools to people who already want to steal money, sabotage infrastructure, and bring down systems. Even the companies developing these AI models acknowledge that the technology can accelerate offensive cyber operations, and there is no guarantee legitimate security researchers will always discover the most dangerous vulnerabilities first.
We’ve been warning about this for months, and today’s news should make people seriously question how much faith they’re putting in the technology running their lives. Eventually, someone is going to discover the right vulnerability in the wrong system, and there may be no patch, no warning, and no opportunity to prepare before the damage begins. By the time the public realizes what’s happening, critical services could already be offline.
When the Internet Goes Down, Your Preparedness Plan Had Better Work Without It
This is exactly why we’ve always argued that preparedness means more than stockpiling food or preparing for natural disasters. If your entire life depends on online banking, electronic payments, cellular communications, cloud storage, and companies that may be thousands of miles away, you’re vulnerable to disruptions you have absolutely no control over.
You don’t have to abandon modern technology or live completely off-grid, but you damn well better have alternatives that don’t depend on the same systems you’re preparing to lose. That means keeping cash available, maintaining offline copies of important documents, having backup power and communications, and making sure your family can function when the internet, banking networks, or other critical services are unavailable.
Because when a major cyberattack finally brings down something we all depend on, the time to figure out how to survive without it will already be gone.
Keep Cash and Financial Records You Can Access Offline
A prolonged payment network outage could leave people unable to use credit cards, debit cards, or online banking. Keeping a reasonable amount of cash at home gives you another option when electronic transactions aren’t available, assuming businesses can still operate and accept it.
Keep printed copies of essential account information, insurance policies, property documents, and emergency contacts. You should also have a plan for accessing money if your primary financial institution is temporarily unavailable.
Our job loss survival guide discusses the importance of building financial reserves before an emergency takes away your options.
Build an Offline Information Library
If every medical reference, repair manual, emergency contact, map, and important document you depend on is stored in the cloud, losing internet access could mean losing access to information when you need it most.
Save important material locally, maintain paper copies of essential documents, and keep practical reference books that work without electricity or a subscription.
Our guide to building an offline digital survival library is a good place to start.
Have Communications That Don’t Require the Internet
Cellphones are useful, but they’re not a complete emergency communications plan.
Learning how to use amateur radio and building communications options that don’t depend on commercial internet access can make an enormous difference during a regional outage or larger emergency.
Start with our Ham Radio for Emergency Communications resources. Licensed amateur radio operators can establish communications over appropriate distances even when ordinary internet services are unavailable, although some systems may still depend on repeaters or supporting infrastructure.
Protect Your Own Devices and Networks
While you cannot secure the internet yourself, you can reduce the chances of your equipment becoming part of the problem.
Keep routers, computers, phones, network storage devices, and internet-connected appliances updated. Disable remote access you don’t need, use unique passwords, and enable multifactor authentication wherever practical.
If you manage websites or servers, make sure the underlying software is patched, not just the visible website application. For PHP2Shell, website owners should confirm that the server’s PHP installation has received an appropriate security update and assess whether there are signs of earlier compromise.
And keep offline backups that attackers cannot easily encrypt or erase.
Prepare for Extended Utility and Service Disruptions
Food, water, power, and basic medical supplies are still essential, regardless of whether a disruption begins with a hurricane, a cyberattack, or a major infrastructure failure.
Have drinking water stored, maintain a way to prepare food without relying entirely on the electrical grid, and keep essential medications and household supplies available within safe and lawful limits.
Backup batteries, solar equipment, and other independent power systems can help keep critical equipment running. We’ve covered affordable off-grid solar setups and portable power stations for people looking to build that capability.
Most importantly, test your plans. An emergency plan that requires you to log into an account, look something up online, or wait for a company to restore service may not be much of a plan when those systems are the reason you’re in trouble.
It’s Not a Question of Whether Something Big Will Break. It’s How Bad the Damage Will Be.
Nobody knows when the next major cyber disaster will hit, which systems will be targeted, or how much damage it will cause. But after watching what unfolded this week, it’s becoming increasingly difficult to ignore where we’re heading. Security flaws that sat undetected for more than a decade triggered an international emergency, governments pulled websites offline, and developers scrambled to release patches while hackers were already looking for ways in.
And PHP2Shell was only part of the story. We also saw compromised encryption keys, stolen cloud credentials, hijacked servers, WordPress backdoors, and more vulnerabilities affecting software used across the internet. Meanwhile, the companies developing the world’s most powerful AI systems are openly admitting they’re discovering serious security holes at a rate that could overwhelm the people responsible for fixing them.
We’ve been warning about this for months because the real danger goes far beyond one PHP vulnerability or a handful of hacked websites. We’ve built an entire society around interconnected systems that were never completely secure in the first place, and now we’re handing increasingly powerful tools to anyone capable of using AI to find the weaknesses. Sure, legitimate researchers are using those tools to help protect us, but criminals and hostile governments aren’t going to sit around waiting for the good guys to get everything patched.
Eventually, someone is going to find a vulnerability in something that really matters, whether that’s a major financial network, power infrastructure, telecommunications system, or one of the cloud providers that thousands of businesses depend on. And when that happens, we may not get weeks to prepare or even a few hours of warning. We could wake up to banking systems that don’t work, communications networks that are down, or critical services that nobody can access.
We’ve been warning that this day is coming, and every new security disaster makes that warning harder to dismiss. We’ve created a world that can barely function without the internet, while developing technology that makes finding and exploiting its weaknesses easier than ever. At some point, our luck is going to run out, and when it does, the damage isn’t going to be fixed by telling everyone to update their software.