This blog was originally published as part of CyberCX’s C-Suite Cyber Newsletter series on 30 October 2026.
What happened?
The ability of frontier AI models to find significant vulnerabilities is no longer theoretical. This month, cyber security researchers used AI to identify two critical vulnerabilities over a decade old in PHP, a widely used open-source scripting language that could impact up to 70% of websites globally:
- The PHP Foundation disclosed that the two vulnerabilities, under the right conditions, could allow an unauthenticated attacker to remotely execute malicious code on servers running PHP.
- Amazon quickly confirmed that the vulnerabilities were being “broadly exploited in the wild” as organisations around the world raced to secure their systems.
The release of increasingly capable frontier AI models throughout 2026 has regularly been accompanied by warnings that these tools can find significant, hidden vulnerabilities that humans have missed. The PHP incident represents one of the first high-profile examples of a frontier AI model helping to discover a critical vulnerability before an attacker.
The discovery prompted a worldwide scramble that saw governments and companies taking precautionary action by shutting down their websites until a fix could be found and deployed, and before threat actors could exploit the vulnerabilities.
- If the PHP vulnerabilities were successfully exploited, threat actors could potentially steal sensitive data, disrupt websites, install malware or use the website as a stepping stone to gain access to other parts of an organisation’s network.
Why it matters
AI is amplifying threat actors’ ability to detect and exploit weaknesses at a magnitude previously unseen. Cyber security experts around the world are sounding the alarm for organisations to secure their defences, remain vigilant and expect an increase in compromise disclosures in the coming weeks and months:
- With the release of the Australian Signals Directorate’s Annual Cyber Threat Report 2025-2026 this week, Director General Abigail Bradshaw, warned that frontier AI models have redefined the threat facing Australia, and that with each capability increase, more disruption is likely, and system security must be prioritised over system availability.
- As reported in SelfCybr: Anthropic Deputy CISO, Jason Clinton told CyberCon in Melbourne this month that we can expect to see a ‘Log4j level’ vulnerability discovery almost every month for the next 18 months. The 2021 Log4j incident is thought of as one of the most significant software vulnerabilities ever disclosed.
Threat actors have never before had such powerful capabilities to automate vulnerability discovery, gain initial access and escalate privileges.
Organisations should act now to move beyond reactive security approaches, identify and patch vulnerabilities fast and prioritise rapid remediation. Systems and defences must stand up to a threat environment that is more conducive to cyber attacks, or risk being left to manage the fallout and financial implications if one does occur.
How could this impact me and my organisation?
The PHP disclosure has changed the equation for vulnerability discovery as the window between a vulnerability becoming known and an attacker exploiting it shrinks further. For organisations, this means more weaknesses will surface more often, and greater pressure will be placed on stretched security teams to act as the need to patch within hours, not days or weeks, is a necessity.
While the PHP disclosure was discovered by security researchers, the risk that threat actors will use these same tools and capabilities is very real. Attackers will have improved abilities to surface previously unknown vulnerabilities, using agents to revisit old code, dismissed findings and potential entry points to systems that may lay undetected for years.
Organisations using traditional or now outdated methods to monitor and detect threats will be at greater risk of a cyber attack if efforts to introduce automated solutions are ignored or delayed.
Leaders should ask the CISO:
- If AI can expose weaknesses in our organisation’s systems today, would you know what systems we rely on, who is responsible for them, and how fast can a fix be deployed?
- How are we using AI for vulnerability management and do we have appropriate visibility of vulnerabilities across our systems and third-party suppliers?
- If we have to take our systems offline, have we tested our ability to continue delivering our most essential services while we contain a threat?
What should I do?
- Review and update asset inventory: Regularly monitor and track all systems, software, internet-facing assets and business processes, and identify any potential blind spots like legacy systems and third-party services. When a critical disclosure arises or new vulnerabilities emerge, it will enable your security teams to quickly identify which systems and business operations are affected.
- Monitor continuously and respond fast: Threat actors are using machine speed AI capabilities to find and exploit vulnerabilities. Organisations must use AI for cyber defence by leveraging its automated threat detection capabilities to move beyond just software patches and lower their breach exposure. When vulnerabilities are detected, security teams need the authority to act fast. Establish automated remediation authority, processes and tools to immediately take vulnerable internet-facing assets offline when critical vulnerabilities are identified.
- Test organisational resilience: Organisations should prepare for disruptions and test whether their systems and critical business functions can still operate if taken offline and explore alternative methods to avoid significant business disruption. Exercise scenarios where critical vulnerabilities take systems offline to help test how your organisation would respond, protect customers and recover.
