What broke
PHP is one of the building blocks of the web, sitting alongside the likes of HTML and Python. On Wednesday, October 21, the core team that maintains it shipped emergency security patches for flaws that had been hiding in the code for years, undetected until AI was used to surface them. The team's message to everyone running PHP was blunt. Update immediately.
Nadella: 'I've not seen anything like this'
Satya Nadella summed up the mood of the week in a single line.
"I've not seen anything like this in a long, long time. It was a long day and a long night, I know, for all the IT and security folks," the Microsoft CEO said.
He made the comment at an industry event in Germany, and used it to push a point he often returns to, that software has to be built to be maintainable and secure as the systems on top of it grow more and more complex.
Coming from the head of Microsoft, "I've not seen anything like this" is not a throwaway remark.
The attacks moved at machine speed
The real damage came from timing. Madeline Lawrence, co-founder of the Belgian security firm Aikido Security, pointed out that the technical details of the bugs reached the public before most organisations had their patches in place, which handed attackers a clean window.
"Companies are racing to update against attackers who can use AI to exploit them. That's the whole race," she said. Cloudflare, which sees a big slice of global web traffic, confirmed how fast it moved.
Its chief executive Matthew Prince laid out the timeline on X, and it reads like a countdown. Thousands of probing attempts were already logged around ten hours before the public disclosure. Forty-five minutes after the announcement, that was tens of thousands.
Two hours in, hundreds of thousands. The sustained volume now runs into the millions.
Websites went dark worldwide
Faced with that, a lot of organisations simply shut the doors. From Tokyo to Helsinki, emergency shutdowns hit banking portals, rail services, flight bookings, tax departments and municipal systems. Dozens of major corporations and state ministries cut public access entirely while their engineers rushed patches out.
Well-known corporate names suspended big online operations across Japan, France, Finland, China and South Korea.
Why it matters
What makes this one land differently is that AI is on both sides of it. The flaws were dug out of old code with AI, and attackers are now using AI to exploit them at a pace no human patching cycle was designed to match.
The gap between a vulnerability being disclosed and being weaponised used to be measured in days. This week it was measured in minutes. The quiet, aging open-source code that keeps the world online just took one of the hardest stress tests it has ever had, and the people who maintain it are the ones who got the long night.