Researchers announced vulnerabilities that could affect large portions of the internet, identified through teams of cybersecurity professionals using artificial intelligence tools. The issues involve PHP, an open-source programming language used by content management systems including WordPress, which powers numerous websites such as the Center for Investigative Reporting. If left unpatched, the vulnerabilities could allow attackers to gain control of websites, inject malware, or steal user data. The announcement prompted cybersecurity teams globally to rush to apply patches released by PHP developers, while agencies in Europe and Canada temporarily took down some government websites for updates. According to reporting from the Wall Street Journal, the vulnerability type had been documented decades earlier but was considered too difficult to exploit and largely overlooked until August, when researchers employing new models discovered a method to exploit it. These models included Google’s most recent release and one from OpenAI issued in July. OpenAI described the discovery as “one of the most impactful security issues in recent memory,” though it forms part of a broader trend. A graph compiled by the research nonprofit Epoch AI indicates that the number of significant vulnerabilities reported monthly by major technology providers and open-source projects has risen sharply: a few years ago, such reports typically numbered in the dozens per month, whereas current months often see around 600. OpenAI noted in its statement that the vulnerabilities disclosed recently represent only a few among several significant issues already identified and being addressed, with similar findings expected to increase markedly in the coming months. Greg Brockman, president and deputy chief executive officer at OpenAI, stated separately that the process for developing fixes for the PHP bug was slow and manual, a method unlikely to scale as more exploits emerge. He suggested that governments may need to assume a significantly larger role in monitoring internet infrastructure, potentially intervening to patch vulnerabilities on external servers. Cybersecurity has become a central concern for AI developers and policymakers, particularly following April, when Anthropic’s Claude Mythos Preview demonstrated the ability to autonomously discover and exploit critical software flaws. In response, Anthropic delayed the model’s release, and both Anthropic and OpenAI have since granted trusted partners—including large corporations and government entities—early access to their models to strengthen cyberdefenses. Experts consulted in August indicated that AI systems capable of facilitating advanced cyberattacks were likely only months away from deployment. Much of this concern centered on open-weight models, which can have their safeguards removed and typically lag behind leading closed-weight models by six to twelve months in capability. The risk, analysts noted, is that malicious actors could soon access models comparable to Claude Mythos, enabling them to target institutions with weaker cybersecurity measures—from municipal utility providers to local hospitals. While open-weight models present such risks, the current findings underscore broader cybersecurity implications beyond them. Additional reporting revealed that threat actors automated attacks against approximately 400 financial institutions across Latin America using models developed by Anthropic, the Chinese firm Moonshot, and Elon Musk’s company SpaceXSI (formerly SpaceXAI, formerly xAI). These actors reportedly bypassed safeguards by framing their activities as testing in benign environments. Beyond web security, leading AI models are now solving complex mathematical problems previously unsolved by top mathematicians and advancing research in physics. They are also assisting in protein and virus design, offering potential benefits in medicine while raising concerns about misuse in bioweapons research. The dual-use nature of these capabilities underscores the growing complexity of managing artificial intelligence’s societal impact. Addressing these challenges will require sustained effort across technical, regulatory, and institutional domains.