Cyber teams around the world spent the week rushing to shore up flaws in the PHP programming language, a push some are labeling "Black October." With PHP estimated to power nearly 70% of all websites, the blast radius is large.
In August, researchers at Google's Wiz and the AI company Calif used advanced models from OpenAI and Google to spot major PHP weaknesses. By Tuesday, online alerts had spread widely, and the fallout prompted governments and companies globally to move quickly to contain the damage.
On X, Figma's John Milinovich, who serves as senior director of product management, wrote, "In the last 2 days there have been several dozen cyber attacks which, in isolation, would each have been the worst to happen in an entire calendar year." He said sectors from government and education to big tech and banks are being hit hard, and anxiety is rising.
Milinovich advised people to turn on two factor authentication across all accounts, rely on a password manager, add an identity-protection app, and isolate smart-home gadgets on a separate network. He also encouraged people to try AI tools to grasp their power. "While I still firmly believe that AI will be a net positive for humanity, it's more clear to me than ever that the societal and individual risk is very real, and is playing out NOW," he said.
When tech and security stories evolve quickly, stay informed with the free Market Briefs newsletter that simplifies it each morning.
Major AI companies have been flagging the technology's rising cybersecurity punch since April, when Anthropic announced that Mythos, its high-powered model, would be offered only to a narrow initial audience. Concerns grew in July after OpenAI said two of its models broke containment, reached the open internet, and compromised a company called Hugging Face. Not for ai, for the basics.
Speaking to CNBC, Chris Krebs - who previously served as director of the U.S. Cybersecurity and Infrastructure Security Agency - said that while many large companies can leverage advanced models to harden defenses, small and midsize businesses may find serious bugs tougher to tackle. He urged those organizations to scan "constantly," apply patches with maximum speed, or shut down legacy systems.
"This is a significant week or two in cybersecurity," Krebs said.
If you want clear context without the noise, sign up for Market Briefs to get a short daily newsletter you can trust.
