By Andrew Lai, Managing Director, Boab AI and Lead, SMEC AI
On 22 October 2026, the United States National Security Agency issued a rare public warning. Every organisation running PHP should patch immediately or take its systems offline. PHP is the language behind about seven in ten websites and every WordPress site. The Australian Signals Directorate issued a critical alert the same day. Its own cyber.gov.au site went offline for a period, and so did government services in the Netherlands, Finland, France and Denmark.
The two flaws let an attacker run code on a server without logging in, and they affect every version of PHP released in more than a decade. According to Google-owned security researchers, they were found with AI.
PHP was only the most recent example, because on the same day GitLab patched a flaw rated a perfect 10 that reached back twelve years. Railway, a cloud platform popular with startups, told every customer to rotate every credential after an intruder decrypted its store of secrets. Railway called it part of a series of attacks on platform companies. Vercel was breached earlier this year through a third-party AI tool that one of its staff connected. Self-spreading worms have been poisoning the package registries that modern software is built from since last year.
Software has always been built based on a supply chain of existing packages and libraries. A typical business website is a stack of parts written years ago by volunteers and small teams. Many of those parts carry flaws that have sat unnoticed for a decade or more. Nobody found them because reading old code that closely was slow and expensive expert work. Now AI can read a codebase the size of PHP and find what twenty years of human eyes missed. It does not care whether the person asking is a defender or an attacker.
I have been writing about this since June, when the Five Eyes agencies warned that the timeline for AI-driven attacks was 'not years, it is months'. In August I worked through the economics using a security firm's benchmark. DeepSeek's open models found freshly disclosed vulnerabilities for around $4.50 each, while Anthropic's top model cost more than $100 for the same result. I argued that attacks on small firms would start the moment the arithmetic worked for the people running them.
Since then, DeepSeek released a newer Flash model. It costs as little as 15 cents per million input tokens and 60 cents per million output, against $10 and $50 for Claude Fable 5. That is a gap of roughly seventy times, and on these tasks the open model performs close to the frontier models from Anthropic and OpenAI. In the same benchmark Z.ai's GLM 5.3 came within one vulnerability of Anthropic's Opus 5 at about 70 per cent less cost. The same kind of capability that found this week's PHP flaws now costs cents to use. The models are free to download, run on your own hardware and are improving at a blistering pace.
Every library and plugin the world depends on is about to be read properly for the first time, and this week is an early instalment. Some of the flaws that surface will be found by defenders and patched before anyone can use them. Others will be found first by the people who want to use them. Weeks like this one, with several critical fixes landing at once and governments taking their own sites offline, are what the next few years look like.
The ASD alert went out within hours of the embargo breaking. Its own site was offline for several hours, and the Home Affairs minister's office issued a statement that night. For a large organisation with a security team reading cyber.gov.au, the warning system worked.
Small and medium businesses make up 98 per cent of Australian companies and very few of them employ anyone in security. The typical one has a WordPress site on shared hosting set up by a web designer years ago. Nobody there reads security advisories or knows the site runs PHP, and there is no budget for someone who does. The NSA has said it will follow its warning with specific guidance for organisations that depend on PHP. In Australia that outreach has to run through the people small businesses already deal with, their hosting providers, web developers, accountants and industry associations. An alert on a government website will never find them.
If you own a small business, do three things right away. Ask whoever hosts your website if they installed the patched PHP versions. If they cannot answer, that is your answer. Write down every website and online tool your business runs, because the next flaw will arrive in one you forgot. Turn on multi-factor authentication and test that your backups restore. The Australian Signals Directorate puts the average cost of a cybercrime report from a small business at about $56,600.
I called this piece the cybersecurity apocalypse because the word means an uncovering, and that is what is happening. Twenty years of hidden flaws are being uncovered at machine speed, and the businesses least able to respond are finding out last.