Ondřej Sury surfaced in the warning over a critical PHP flaw found with AI on 21 October. The problem matters because PHP runs across millions of websites, and attackers were already moving before the alert finished spreading.
Matthew Prince said Cloudflare saw thousands of people trying to exploit the PHP flaws in the 10 hours before the announcement. He said that jumped to tens of thousands in 45 minutes, then to hundreds of thousands within 2 hours, and now sits in the millions.
Cloudflare counts the surge
That pace turns disclosure into a race for administrators. Sites running PHP had to patch quickly, and government and private websites across the US and UK temporarily took sites down while they applied fixes.
The NSA told any site running PHP to implement the patches immediately. It also said malicious cyberactors may try to use the bugs to access servers without authorization.
AI finds flaws faster
The story is not just that AI helped uncover the vulnerability. It is that the same tools that help defenders find bugs may also help attackers find and use them faster than patch cycles can keep up.
Sam Altman said, "I no longer think we’re going to be able to patch all bugs," on Thursday evening. Jason Clinton said, "There won’t be enough time to patch critical infrastructure," and Marc Benioff called the situation "a code red".
Black October pressure
Prince wrote that the next two years are going to be "incredibly, incredibly, incredibly fraught with new tools that have infinite patience to go look for vulnerabilities across the Internet," and he warned, "It’s going to feel like the sky is falling. It’s going to feel like there’s nothing we can do."
The open question is the specific PHP flaw itself. The source does not explain how it works, so site operators are left with the practical order to patch now, not wait for a fuller technical postmortem.
