AI Can Now Hack the Internet — and 7 Ways to Protect Yourself Today

On 21 October 2026, governments worldwide chose to shut down their own websites outright, rather than risk exposing them to an automated AI-driven cyber attack. The cause of this unprecedented action was the discovery of severe vulnerabilities in PHP, a programming language that powers 69.3% of server-side websites. These vulnerabilities, known as PHP2Shell, were rated 9.2 in severity and allowed attackers to execute commands without a password, gaining direct access to sensitive files, databases, and encryption keys.

Independent researchers used AI models, such as OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon, to quickly identify the PHP2Shell flaw, which had gone undetected since 2012. The US National Security Agency urged immediate patching or disconnecting from the internet due to the urgency. Several countries, including the Netherlands, Finland, and France, followed this directive and temporarily shut down their major state networks to protect against the imminent threat.

Historically, malware relied on brute force, but recent developments have seen AI-assisted malware evolve into more sophisticated, self-learning programs. Researchers demonstrated how an AI worm could successfully spread from one device to another in a controlled environment by learning from previous mistakes and adapting its strategies. This advancement highlights the growing capabilities of AI in both defense and offense within the realm of cybersecurity.