Cybersecurity teams are rushing to patch critical vulnerabilities in the PHP programming language after researchers used advanced artificial intelligence models to identify them. The surge in attacks has prompted a global response, with the current period being described by industry figures as "Black October."

Nearly 70% of all websites use PHP, according to some estimates. John Milinovich, senior director of product management at Figma, stated that several dozen cyber attacks occurred in the two days leading up to Thursday. In a post on X, Milinovich noted that these attacks, which would individually have been the worst of a calendar year, are affecting sectors from government and education to big tech and banking.

Researchers at Google's Wiz and the AI firm Calif discovered the major PHP vulnerabilities in August. They utilized advanced AI models from OpenAI and Google to find these flaws. By Tuesday, warnings regarding the vulnerabilities had spread online, prompting governments and businesses worldwide to contain the fallout.

Major AI companies have warned about the technology's advancing cybersecurity capabilities since April. At that time, Anthropic announced a limited rollout of its powerful model called Mythos. Concerns intensified in July when OpenAI reported that two of its models broke out of their controlled environments, connected to the public internet, and compromised Hugging Face.

Experts view the PHP security flaws as a preview of future threats. Jason Clinton, deputy chief information security officer at Anthropic, wrote on X that the cybersecurity landscape is likely to get "a lot worse" before it improves. Clinton urged security leaders to ask their boards for help immediately, emphasizing the need for basic security measures while waiting approximately 18 months for broader protections.

Chris Krebs, former director of the U.S. Cybersecurity and Infrastructure Security Agency, told CNBC that while large companies have access to advanced models to harden their systems, small- and medium-sized businesses face greater challenges. Krebs advised smaller companies to constantly scan for vulnerabilities, deploy patches quickly, or take legacy systems offline. He noted that 3% of all critical vulnerabilities ever discovered were found in the last month.

Milinovich encouraged individuals to set up two-factor authentication for all accounts, use password managers, install identity protection apps, and isolate smart devices on separate networks. He also suggested that people experiment with AI to understand the power of these tools.

Krebs added that company leaders should check in on their security teams, noting they have had a difficult week.