Tech • AI • Robotics • Game
It's Happening... AI Just Started the Biggest Internet Nightmare in History
TL;DR
A wave of 27 major cyber incidents in 48 hours exposed weaknesses across core internet software, browser security, certificate authorities and AI supply chains, while governments and companies rushed to take services offline before attackers could exploit newly disclosed flaws.
KEY POINTS
Internet stack hit at multiple layers
Critical flaws surfaced almost simultaneously in Linux, NGINX, GitLab, Node.js, Go, Chrome and PHP, creating what security researchers described as one of the most dangerous patch windows in years. The clustering mattered because these tools sit at different layers of the internet stack, from cloud hosts and databases to web servers, browsers and application runtimes.
Linux, NGINX and GitLab flaws raised takeover risks
A Linux bug disclosed on October 15 allowed a breakout from a virtual machine to host-level root access, potentially exposing neighboring cloud tenants. NGINX patched five flaws on October 14, including three rated 9.2, with some enabling memory corruption, code execution or bypass of mutual authentication checks. GitLab fixed two 10.0 severity bugs in October that could let attackers seize self-hosted servers without logging in.
Chrome fixes showed AI’s growing role in vulnerability discovery
Chrome 156 shipped on October 20 with 353 security fixes, far above the 21 and 26 fixes seen in comparable releases a year earlier. Six bugs were classed as critical, including a 9.6 issue that could let a malicious webpage escape Chrome’s sandbox. Five of those six critical bugs were credited to researchers at AI companies, underscoring how machine-assisted auditing is accelerating bug discovery.
PHP flaws triggered emergency shutdowns across Europe and Asia
The most disruptive issue centered on PHP, which powers 69.3% of websites with an identifiable backend, or more than 33 million sites. Two bugs, nicknamed PHP2 Shell, were rated 9.2 and could let a single request give an attacker shell access, meaning full server control without a password. Governments in Finland, France and the Netherlands took services offline, while disruptions also affected Germany, Belgium, Wikipedia, Nintendo, Pixiv, Niconico, Sushiro and Final Fantasy XIV services in China.
Old PHP versions face lasting exposure
The bugs reportedly date back more than a decade, to PHP 5.4.4, and were compared by maintainers to Heartbleed in systemic impact. Patches were issued only for PHP 8.2 to 8.5, leaving many older deployments exposed: about 27% of PHP sites still run version 7, and 7.7% run version 5. Security agencies in the United States, Britain and the EU advised operators to take unpatched sites offline.
Disclosure chaos increased exploitation risk
The PHP release process unraveled when details leaked early on hacking forums, a proof-of-concept reportedly hit live targets, and an early-access distributor shipped patches ahead of schedule. Cloudflare said it observed attacks six hours before the official patch. The episode highlighted a recurring dilemma: once partial details surface, defenders and attackers race on the same clock.
Certificate authority failure exposed trust model weakness
Indian certificate authority eMudhra was found to have issued intermediate certificates protected by catastrophically weak keys. Instead of having roughly 2^384 possible values, some keys effectively had just 256 possibilities, with one key equal to 4. Browser makers including Chrome, Firefox, Apple and Microsoft began distrusting the certificates, while researchers warned that older devices and embedded systems could keep accepting them for years.
AI infrastructure and API keys became prime targets
The package LiteLLM, downloaded about 23 million times a week, was reportedly poisoned through stolen publishing credentials, creating a supply-chain risk for applications that store API keys. Open Code disclosed a breach affecting 1.4% of console users, with some users reporting unexpected bills ranging from a few hundred dollars to more than $1,700. Hosting platform Railway said an intruder decrypted some stored passwords and API keys, then paused deployments while it rotated systems.
Autonomous and criminal AI use is no longer theoretical
Security incidents increasingly involved AI acting either as an assistant or operator. CrowdStrike linked breaches at several South Korean financial institutions to Artex, an open-source AI hacking agent, and said AI-powered attacker activity rose 89% in 2025. The average time from initial compromise to lateral movement fell to 29 minutes, with the fastest case recorded at 27 seconds.
AI is also strengthening defense through formal verification
Defensive uses advanced just as quickly. A joint effort by Anthropic and Theorem Labs applied proof-based analysis rather than random fuzzing, verifying 239 entry points across 123 projects and finding bugs that trillions of conventional tests had missed. In one case, the system reportedly found a year’s worth of vulnerabilities in a widely used PDF reader within a week, suggesting AI could reshape software assurance as much as software offense.
CONCLUSION
The immediate danger came from exploitable flaws in foundational software, but the broader shift is that AI is compressing the time needed to find, weaponize and verify bugs. That leaves governments, browser vendors and software operators in a race to patch faster than both human and machine-driven attackers.
Ask a question