Sam Altman says the bugs can't all be patched as AI-driven 'Black October' shakes security

AI found security holes in PHP so deep that some experts estimate 70% of all websites on the internet were exposed to hackers — potentially for years. That discovery, announced on 21 October and now being called "Black October," has pushed some of the most senior names in tech to declare that the security industry cannot keep up with what AI-driven vulnerability discovery is about to unleash.

"I no longer think we're going to be able to patch all bugs," Sam Altman said on Thursday evening. It is a striking admission from the CEO of OpenAI, the company whose models sit at the center of the AI boom, and it matches what other executives have been saying publicly since the PHP disclosure.

The immediate facts are dramatic enough on their own. Researchers used AI to help identify critical flaws in PHP, a programming language that runs across millions of websites. Some experts estimated that 70% of all sites on the internet were at risk of hacking, and that the underlying flaws may have sat unpatched for years — in some readings, for decades. Researchers at the AI security platform Wiz called it "among the most severe vulnerabilities discovered in PHP, and arguably in software history."

The stakes here are structural, not incidental. PHP is not a niche tool; it is plumbing for a large share of the web. When a flaw sits in a language that widely, every site built on it inherits the problem, and no single vendor can fix the internet with one update. That is why this story matters beyond the security beat: it is a live test of whether the global patching machinery — vendors, governments, hosting providers, individual site owners — can move faster than AI-assisted attackers can. So far, the evidence says it cannot.

What happened during 'Black October'?

On 21 October, researchers announced that they had used AI to help find a flaw as fundamental and critical as the one in PHP. That marked a turning point. Cybersecurity experts have been warning about a "vulnpocalypse" — the ability of AI to more easily identify security bugs — for months. But warnings are one thing. Until "Black October," researchers had not actually used AI to surface a defect this deep in software this widely deployed.

The Wiz researchers explained why nobody had caught it before. "The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve," they wrote in a blogpost. In other words, the bugs were findable in principle but not in practice — until machines got patient enough and capable enough to walk the chain.

That word, patience, is the mechanism underneath this whole story. Human researchers burn out, get distracted, and move on. AI tooling does not. It can grind through code paths, edge cases, and exploit chains at a scale no security team can match. The result is a sudden widening of the pipeline that turns theoretical weaknesses into demonstrated, weaponizable vulnerabilities.

After the vulnerabilities were announced, government and private websites across the US and UK temporarily took their sites offline to patch the bugs. Taking a public website down is a costly, visible move — it signals that operators judged the risk of staying up as worse than the disruption of going dark.

How fast did the attacks come?

The exploit attempts did not wait for anyone's incident-response plan. Matthew Prince, the CEO of security provider Cloudflare, posted evidence on X that shows the speed in blunt numbers.

Prince said Cloudflare had seen thousands of people trying to exploit the PHP flaws in the 10 hours before the announcement. "That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now," he wrote.

Read those intervals again. The attempt count grew roughly a thousandfold between the pre-announcement window and the moment the disclosure went public. Attackers monitor disclosures the way traders monitor earnings, and they moved faster than most site operators possibly could.

The US National Security Agency issued an alert recommending that any site running on PHP implement the patches immediately. The agency's warning was direct about the consequences. "Such an access vector could help attackers steal sensitive data, disrupt services or move deeper into a network," it read. Government sites were not exempt from the scramble; the temporary takedowns spanned both the US and the UK.

Why executives are calling it a 'code red'?

The loudest warnings come from people who run the infrastructure that will have to absorb this. Jason Clinton, Anthropic's deputy chief information security officer, predicted a "vulnerability tsunami" over the next few months. "There won't be enough time to patch critical infrastructure," Clinton wrote on X on Thursday evening. Marc Benioff, the CEO of Salesforce, called the situation a "code red."

Prince put the timeline in the sharpest terms. "The next two years are going to be incredibly, incredibly, incredibly fraught with new tools that have infinite patience to go look for vulnerabilities across the Internet," he wrote. In another post he framed the emotional reality for defenders: "It's going to feel like the sky is falling. It's going to feel like there's nothing we can do."

That is not a technical assessment so much as a psychological one. Prince's point, laid out plainly, is that AI is uniquely able to find and identify security flaws at a pace the security community cannot match. The bottleneck is no longer discovery. It is response — and response is staffed by humans with calendars, budgets, and queues.

What cuts both ways?

The executives' deeper worry is symmetry. The same AI that researchers used to find the PHP flaws — and to do so before criminals did — is available to malicious actors. Tech leaders say AI will be used both to identify vulnerabilities and to exploit them at an unprecedented scale and pace. The PHP case already shows the second half of that equation in motion, with exploit attempts numbering in the millions after disclosure.

That dual use is what separates this moment from ordinary vulnerability news. A new bug is a race between patchers and attackers. A new method for finding bugs at machine scale is a change to the entire race calendar. The Wiz researchers' point about flaws present "for decades" is the uncomfortable part: the code was always weak. AI just made the weakness visible, and visibility now belongs to everyone at once.

What happens next?

The next few months, in Clinton's framing, bring the "vulnerability tsunami" — more AI-found flaws, hitting infrastructure that cannot patch fast enough. Prince frames the horizon as two years of tools with "infinite patience" combing the internet for weaknesses. Altman, for his part, has already conceded the endgame: not all bugs will get patched. How governments, hosts, and site owners triage that reality — starting with the PHP patches the NSA says should go in immediately — will define whether "Black October" becomes a one-time shock or the new baseline.