Be Prepared: AI Is Accelerating Cyber Risk, And Ignoring It Is Reckless

“This is not a drill.”

— Lukasz Olejnik, visiting senior research fellow at King’s College London, on the PHP vulnerabilities, October 21, 2026

Today I attended the IT-ISAC’s threat presentation on cyberattack trends in 2026, titled “Make It Harder: Turning Today’s Cyber Threats into Action.” Among the trends it highlighted was one that should keep every executive and board member up at night: AI is accelerating vulnerability discovery, and with it, cyber risk itself.

The warning did not stay theoretical for long. Roughly coinciding with the presentation, government websites across Europe went dark. Their operators pulled them offline as a precaution against critical, AI-discovered vulnerabilities in PHP, the code running beneath most of the web. Hackers were already exploiting the flaws.

My thesis is simple. AI has changed the speed of cyber risk. Ignoring that change is no longer an oversight; it is reckless. Preparedness is paramount.

The Proof: AI Found What Humans Missed for Years

PHP is free, open-source software, maintained by volunteers, that assembles web pages on the server. It is baked into WordPress, Drupal, Joomla and Magento, and W3Techs says it runs roughly 75% of websites whose programming language can be identified. The PHP Foundation disclosed two flaws, each rated “critical” at 9.2 out of 10, affecting “all PHP installations serving web requests” back to PHP 5, released in 2004. According to Wiz, they “can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory,” including passwords, tokens, API keys and certificates.

These flaws were found with AI. Calif said it found them with the help of a large language model on August 1. Wiz said it discovered them using its autonomous AI research tool along with Google and OpenAI models, and OpenAI said its own program contributed. Per Wiz, the flaws had sat in the PHP codebase for more than a decade and would have been extraordinarily complicated for a human hacker to exploit.

Then came the sentence that captures the IT-ISAC’s warning better than I can: “Pre-AI, this manual work would be difficult to implement and even harder to scale,” Wiz wrote. “With AI, this is no longer a barrier.”

Take Note: complexity used to be a kind of accidental defense. A flaw too hard to find or exploit was, in practice, a flaw no one used. AI removes that cushion for defenders and attackers alike, and the advantage goes to whoever moves first.

The Collapsing Clock

The reported timeline shows how little room defenders had:

Once a fix is public, experts warned, AI tools can reverse engineer the bug with little effort. Costin Raiu of TLP:Black called it an AI-powered “race to exploit,” with the next step being the “mass compromise of every vulnerable web server on the internet.” Olejnik put the window bluntly: “AI makes exploiting such vulnerabilities of immediate importance. Like, indeed, a minute or so.”

So you see, the old rhythm of disclosure followed by a reasonable window to patch no longer holds. Exploitation attempts were reported before disclosure, and predicted within minutes after it. The patch is no longer only a fix. It is also a roadmap.

Ignoring the Risk Is Reckless

“Reckless” is a strong word, and I use it deliberately. In law, the line between carelessness and recklessness often turns on awareness: recklessness generally means consciously disregarding a known risk. After Wednesday, no organization can credibly claim this risk is unknown.

The warnings could not have been more explicit. The PHP Foundation wrote: “There are no complete mitigations, updating is the only safe choice.” The UK’s NCSC advised that where immediate remediation is not feasible, organizations “should consider taking the system offline.” Japan’s Prime Minister told website owners to “check whether your live site uses PHP.” The FBI’s cyber assistant director, Brett Leatherman, told organizations that find signs of compromise to “isolate the system, preserve your web server and PHP logs, and report it to your local FBI field office.” And governments acted on their own advice: the Dutch National Cyber Security Centre took its own website offline, Finland’s state IT provider took government public network services offline, and France’s Interior Ministry put all of its websites into preventive maintenance. In the Netherlands, organizations from the Port of Rotterdam to hospital websites followed the NCSC’s example.

Two blind spots turn ignorance into exposure. The first is the forgotten system: only PHP 8.2 and newer will receive patches, and Censys reported that about 1.5 million of 2.6 million hosts run a version of PHP with no fix. The second is dependence: Reuters reported the risk was higher for small sites on shared hosting, where customers do not manage the underlying servers. An organization that does not know what it runs, or who runs it, cannot act in a window measured in minutes.

Put simply, the risk is now foreseeable, fast, and documented. Choosing not to prepare for it is a choice.

Preparedness Is Paramount

If the clock is now measured in minutes, preparation is the only part of the timeline an organization fully controls. The decisions that mattered most on Wednesday were not technical. They were business, legal and communications decisions made under pressure. Every organization should be able to answer these questions before the next emergency, not during it:

• Do we know every system we run on PHP, or any other foundational software, including the ones a vendor or hosting provider manages for us?
• Who has the authority to take a system offline, and how fast can that decision be made?
• What do we tell customers, partners, and employees if we go dark?
• What are our notification obligations to regulators, contractual counterparties, and our insurer?
• If we find signs of compromise, who preserves the evidence, who reports to law enforcement, and who leads the investigation?

This is why we at OnCall Cyber have focused on preparedness and on the Cyber Crisis Team. A crisis like Wednesday’s cuts across IT, legal, executive leadership and communications at the same moment. If those people meet for the first time during the emergency, the organization has already lost the minutes that matter.

My view, shaped by a career that ran from advising Army cyber operations commands to serving as Legal Advisor to US-CERT, is that the organizations that respond well are the ones that rehearsed the decision before they had to make it.

Make It Harder — Starting Now

The IT-ISAC chose its title well. The threat trends are clear, AI is accelerating them, and on the very day of the briefing, the PHP emergency showed what that acceleration looks like in practice. I do not expect it to be the last AI-discovered vulnerability of its kind.

So here is my call to action. This week, ask your leadership three questions: Do we know what we run? Who decides when to pull the plug? And when did we last rehearse it? If the answers are unclear, that is the vulnerability to fix first.

The risk is accelerating. Ignoring it is reckless. Preparedness is paramount.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.