EFF warns of 'Vulnerability Apocalypse' as AI accelerates PHP exploits
The rise of frontier AI models has made discovering and exploiting software vulnerabilities significantly cheaper and faster, leading to a surge in reported CVEs.
Summary
The Electronic Frontier Foundation (EFF) reports a massive surge in software vulnerabilities, driven by the ability of major AI models from companies like OpenAI and Anthropic to identify exploits. A recent crisis involving PHP, which powers nearly 70% of the web, demonstrated how unpatched vulnerabilities can lead to widespread site outages. The EFF argues that this 'Vulnerability Apocalypse' highlights the urgent need for increased corporate funding for critical open-source infrastructure.
The impact of AI on vulnerability discovery
- AI models have lowered the barrier to entry for finding zero-day exploits, allowing users with moderate technical skill to find vulnerabilities via simple prompts.
- In October 2026 alone, 13,000 new CVEs were submitted, representing 3% of all officially logged vulnerabilities since 1988.
- A critical PHP vulnerability, originally discovered in 2024 but deprioritized, was rediscovered and weaponized by researchers using OpenAI and Anthropic models.
- As of the report, over 33 million websites remain running on vulnerable versions of PHP.
Why it matters
The ease of automated vulnerability hunting threatens the stability of the web, which relies heavily on volunteer-maintained open-source projects like PHP.
What to do
- Website administrators using PHP should apply patches to fix severe vulnerabilities that allow for data theft, malware attacks, or denial of service.
- Users of Node.js and GitLab should monitor for and apply fixes for recently reported severe security bugs.
Original reference: www.eff.org →