Black October: why bugs discovered by OpenAI tech are creating a cyber emergency

OpenAI's artificial intelligence (AI) technology recently uncovered critical vulnerabilities within PHP, a programming language that powers millions of websites worldwide. These flaws, dubbed "php2shell," could allow hackers to take control of servers and steal sensitive data or user credentials. On October 21, 2026, governments and companies took websites offline to install security patches, prompting the National Security Agency and Europe's cybersecurity agency to take notice.

PHP, or Hypertext Preprocessor, is a programming language used by approximately 70% of websites with known server-side languages. Despite its ubiquity, the PHP vulnerabilities managed to evade detection for over a decade, likely due to the technical complexity involved in exploiting them. OpenAI claims that its AI technology detected these bugs ahead of potential attackers, describing the discovery as one of the most impactful security issues in recent memory.

Cybersecurity firms have urged anyone using PHP to install the security updates immediately, as the vulnerabilities could allow hackers to steal sensitive information or take control of affected servers. The disruption caused by the patching process affected dozens of websites, including those in the U.S., U.K., and beyond, causing temporary outages for services ranging from developer platforms to public school data leaks and corporate breaches.

Despite the temporary disruptions, cybersecurity professionals have stated that the true impact of these vulnerabilities will only be realized if they lead to significant real-world harm.