This week, an AI model helped uncover a critical PHP vulnerability: a set of security flaws in the programming language that powers about 70% of the websites on earth. The flaws had been sitting in plain sight for decades.
I'm Khalid Parekh, founder and CEO of AMSYS Group in Houston, Texas, and I've spent 22 years and a 97% client retention rate across six business verticals building AMSYS from a $100 investment into a $350 million company (you can read my full story here). I've rarely seen a vulnerability disclosure move this fast, or expose this much about how unprepared most leadership teams still are for the AI era.
Here's what happened, and here's the part that should actually keep you up at night. It isn't the bug.
The Vulnerability, in Plain English
On October 21, 2026, OpenAI announced it had led a two-month effort to fix a set of critical flaws in PHP. Security firm Wiz says PHP powers about 70% of the world's websites.
The flaws themselves weren't new. According to Wiz, they had been present for decades. What changed is that OpenAI's GPT-5.6 Sol model helped the security firm Calif discover them, and Wiz independently found and reported related flaws. Wiz said turning the flaws into a working exploit took an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve, and that frontier AI models substantially reduced that barrier.
Left unpatched, the bug could let an attacker remotely execute code on a server. That means taking control of it and putting sensitive data and networks at risk, on any of those millions of PHP-powered sites.
That's the headline. Here's the part executives should actually study.
A Coalition Moved Faster Than Any Single Company Could Have
PHP's own maintainers prepared the fix, supported by OpenAI, Wiz, Cloudflare and others. Cloudflare says it deployed protections about nine hours before the vulnerabilities were made public, and OpenAI shared a Codex skill that helps operators identify PHP versions that may be vulnerable.
After the announcement, Cloudflare CEO Matthew Prince said there had been "millions" of attempts to exploit the vulnerability in the hours since it was announced. The FBI's cyber division warned that the flaws could allow remote code execution, and recommended that operators take websites offline if they couldn't update immediately.
Governments moved too. Japan's Prime Minister urged operators to apply the fix promptly, and said temporarily suspending websites could be an effective way to reduce risk. The EU's cybersecurity agency, ENISA, advised organizations to take immediate action. The UK and Finland both warned that government services could be affected, and some websites went dark as operators scrambled to respond.
Key takeaway: none of this worked because any one vendor was brilliant. It worked because the response was coordinated, and fixes and protections were prepared before disclosure. That's a leadership and governance story, not just a security story.
The Real Lesson in AI Cybersecurity Leadership
I sit on NVIDIA's Global Enterprise AI Partner Advisory Board, so I spend a lot of time with executives who are excited about what AI agents can do for their business. I wrote about the lessons from that seat in what the NVIDIA AI advisory board taught me about enterprise AI adoption. Most of them haven't fully absorbed what this event showed: frontier AI models can now help find exploitable flaws that went undiscovered for decades.
That cuts both ways, and every CEO needs to hold both sides at once:
- AI is now a genuine defensive asset. An AI model helped surface and fix one of the most impactful vulnerabilities in recent memory. OpenAI said AI appeared to find the flaws before any attackers did.
- AI has also lowered the bar for attackers. Wiz's own assessment was blunt: frontier AI models substantially reduced the barrier to turning a longstanding flaw into a working exploit. Leaders should assume attackers have access to the same capabilities.
This is exactly the tension showing up in the data. Darktrace's State of AI Cybersecurity 2026 report, published via the Cloud Security Alliance, found that 92% of security leaders are concerned about the impact of AI agents on their organization's security. The top worry, cited by 61%, is exposure of sensitive data. Yet only 37% of organizations have a formal AI policy in place, which is actually down slightly from the year before.
Adoption of AI agents inside the enterprise is accelerating. Governance of those same agents is stalling. That gap is where the next breach lives. For a practical starting point, read The Executive's Playbook for Building an AI Strategy That Actually Delivers.
What This Means for Your Business, Starting Monday
You don't need to be a PHP developer to act on this. You need a handful of disciplined habits that most companies still treat as optional:
- Know your stack. If you can't answer "what software and language versions are we running, right now" without a meeting, that's your first fix. OpenAI shared a Codex skill for identifying potentially vulnerable PHP versions. Use it if it applies to you, and demand the same speed of answer from your IT team for everything else.
- Treat patching as a leadership metric, not an IT ticket. The FBI recommended taking websites offline rather than staying exposed. That's a business continuity decision, and it belongs on an executive's desk. Make patch management a standing item in your leadership meetings. I cover more in Cybersecurity for CEOs: What You Must Know Before It's Too Late.
- Govern your AI agents like you'd govern a new hire with admin access. Broad permissions, no oversight, and no formal policy is how 92% of security leaders end up worried while only 37% of organizations have a formal AI policy.
- Build the muscle for speed, not just the plan for it. Cloudflare had protections live nine hours before public disclosure. That kind of speed only happens when the relationships, tooling, and decision rights already exist, not when you start building them during the incident.
After 22 years working with clients across technology, healthcare, insurance, hospitality, energy, and finance, the pattern I see repeat is simple: the companies that get hurt worst aren't the ones with the most exotic threats. They're the ones that treated basic governance as a someday project.
The Bottom Line
An AI model just helped expose, and fix, one of the most widespread software vulnerabilities in recent memory, with a coordinated response that no single company could have managed alone. That's genuinely good news.
But the same event is a warning. AI is now powerful enough to help find decades-old flaws, which means it's powerful enough to help attackers do the same. The leaders who treat AI cybersecurity leadership as a real discipline, starting now, will be the ones telling this story as a case study instead of living it as a headline.
Related reading: Khalid Parekh on AI, Cybersecurity and Enterprise Growth.
Not sure what's running in your stack, or how well your AI agents are governed? Don't wait for the next headline to find out. Talk to AMSYS about a security and AI-governance assessment.