AI Vulnerability Surge Forces PHP Outages, Business Delays

The cost of resolving two vulnerabilities in PHP, an open-source scripting language that powers many websites, is still being calculated. PHP is used by popular content management systems like WordPress, Joomla, and Drupal, and an estimated 70% of websites worldwide were forced to shut down on October 21 to apply a patch released by the PHP Foundation.

When a company shuts down a critical system, it can disrupt the entire cash conversion cycle, delaying invoicing, matching incoming payments, and causing buildup in reconciliation backlogs. Arpit Jain, a graduate student at MIT's System Design and Management program, explained that delayed outgoing payments could lead to supplier disputes or contractual penalties, while cash forecasts become less reliable.

Whether cybersecurity insurance policies cover these precautionary shutdowns depends on the underwriter. Ranjan Pal, a research scientist at MIT's CMAS, clarified that a routine security patch is generally not covered under such policies, but shutting down because of a documented, imminent threat originating from an affected supplier may qualify for coverage.

The rise of artificial intelligence and agentic AI has accelerated reporting of vulnerabilities to the CVE system, which catalogs cybersecurity vulnerabilities. This has led to a surge in submissions, requiring the National Institute of Standards and Technology to adopt a risk-based triage model for analyzing CVEs. Since 1999, the CVE system has issued around 350,000 notices, with an estimated 100,000 expected by the end of the year.

Oracle issued a Critical Patch Update in October, identifying 1,209 unique CVEs, 95 of which were identified as critical severity flaws. The economic incentives for programmers to find vulnerabilities have decreased, as companies prioritize profit over security. AI is expected to increase vulnerability finding, leading to more vulnerabilities being discovered.

Many software vendors have reduced or eliminated their bug bounty programs due to the overwhelming number of vulnerability reports. Although the economic incentive for programmers to report vulnerabilities may be lower, Pal believes the increase in vulnerability reports is positive for businesses, as it will encourage more diligent fixing of vulnerabilities.