The Vulnerability Apocalypse and Why We Should Fund Open Source
Over 33 million websites remain vulnerable after critical PHP flaws were discovered and exploited, highlighting the dangers of underfunded open-source projects in the age of AI-driven security threats.
The internet is reeling from what security experts are calling the 'Vulnerability Apocalypse,' with over 33 million websites still running on vulnerable versions of PHP after critical flaws were discovered and exploited. The incident has exposed a dangerous vulnerability in our digital infrastructure: the open-source software that powers most of the internet is maintained by a small number of volunteers with minimal financial support.
PHP, a programming language used by Facebook, WordPress, Wikipedia, and Etsy, among others, became the focal point of this crisis when severe vulnerabilities were discovered in 2024 but deprioritized by maintainers who couldn't find a way to exploit them. The situation changed dramatically in August 2026 when security researchers using AI models from OpenAI and Anthropic rediscovered these vulnerabilities—and found ways to exploit them.
AI Revolutionizes Vulnerability Discovery
The exponential rise in security vulnerabilities is directly linked to advanced AI models. What once required specialized knowledge and significant resources can now be accomplished by individuals with moderate technical skills and access to frontier AI models. Recent PHP vulnerabilities were reportedly found with a simple prompt: 'find bad vulnerabilities in PHP.'
The scale is staggering—13,000 new Common Vulnerabilities and Exposures (CVEs) were submitted in October 2026 alone, representing 3% of all critical software bugs ever officially logged. By year's end, over a quarter of all known software vulnerabilities will have been discovered in 2026.
Patch Race Turns Chaotic
When the PHP vulnerabilities were rediscovered, researchers coordinated with PHP's maintainers to develop patches and disclose them responsibly. However, the plan unraveled when news began leaking on October 20th. Companies reported active exploitation as early as October 17th, and on October 21st—six hours before the scheduled disclosure—Chainguard released a patch early, essentially publishing a roadmap for hackers.
The vulnerabilities were so severe that they would have allowed even moderately inventive hackers to take over any website that uses PHP and then steal customer data, launch further malware attacks, spy on users, take websites offline, or launch a massive denial of service attack.
Beyond PHP
PHP is not alone in this crisis. Other critical open-source projects like Node.js and GitLab also reported severe security bugs this week. The small number of open-source maintainers are now facing an overwhelming deluge of vulnerability reports, with burnout reaching unprecedented levels.
Much of the modern internet's foundation rests on open-source products created and maintained by volunteers in their spare time. This imperfect system has worked for decades, but the combination of AI-powered vulnerability discovery and limited resources has created a dangerous tipping point. Corporations whose products depend on these projects must provide financial support to prevent further catastrophic failures.
Related
