AI-Found Software Bugs: Why More Outages Are Coming

Short answer: Yes, more disruptions are likely. AI tools now find software flaws faster than humans can patch them, and this week’s PHP emergency showed what happens when two severe bugs land in code that runs a huge share of the web. The open question is whether more discovered bugs will mean more successful attacks. The data so far says not necessarily.

Key takeaways

• • Two critical PHP vulnerabilities, each scored 9.2 out of 10 on the CVSS v4.0 scale, led governments across Europe to pull websites offline on October 21, 2026.

• • AI agents helped uncover the flaws, according to Sky News, and security officials warned that the published patches could help attackers reverse-engineer exploits.

• • The industry forecaster FIRST expects roughly 66,000 CVEs in 2026, a record driven largely by AI-assisted discovery.

• • VulnCheck’s first-half 2026 data shows AI-found bugs are exploited at about the same rate as other bugs: 14 of 1,061, or 1.3%.

• • Cloudflare’s CEO expects “a couple of years” of constant alarms as long-hidden flaws surface.

What happened with PHP this week?

PHP’s developers announced emergency fixes for two critical vulnerabilities, and the EU’s cybersecurity officials told organizations that couldn’t patch immediately to take affected sites offline. Many did. The Dutch government, along with the Port of Rotterdam, several hospitals and the country’s largest political parties, took public sites down. France disabled prefecture websites, Germany’s federal IT provider pulled several sites, Finland shut down some public network services, and Belgium and the Czech Republic made similar moves. Security agencies said the flaws could let attackers run code on a vulnerable server without logging in. Patches for multiple PHP versions went live the same day.

Why does a PHP flaw affect so many WordPress sites?

PHP runs close to 70% of websites whose language can be identified, according to W3Techs, and it sits underneath WordPress, which powers roughly 40% of all sites. Drupal, Joomla and Magento depend on it too. As security firm Huntress put it, “PHP is everywhere.” That reach is the real problem. A single flaw opens the same door on millions of servers at once, and many of those servers belong to small organizations with no security staff, often on shared hosting where the owner doesn’t control updates. Those sites tend to stay exposed long after a fix exists.

Why are AI tools finding so many more vulnerabilities?

Modern AI models can read huge codebases, spot patterns that resemble known bugs, and search for variants of a flaw across the open-source ecosystem. Reuters reports that VulnCheck’s forthcoming research shows the number of discovered flaws doubling year over year, with AI as a major driver. FIRST’s forecast of about 66,000 CVEs for 2026 points the same direction, though it notes that expanded cataloging and backfilled records also inflate the totals. Researchers at Google’s threat intelligence group found that AI-discovered flaws skew more serious than average. Over half were medium severity or higher, against under a third of all disclosed flaws, and half enabled remote code execution, compared with 26% overall.

Will more AI-found bugs mean more hacks?

Experts disagree, and the evidence is mixed. The reassuring case. VulnCheck’s State of Exploitation report for the first half of 2026 counted 1,061 AI-attributed vulnerabilities. Only 14 had been exploited in the wild, a rate in line with all other vulnerabilities. Disclosure volume has grown much faster than exploitation. The worrying case. Attackers are getting faster once a patch ships. VulnCheck found the average time from CVE publication to exploitation fell from 120 days in 2025 to 80 days in the first half of 2026. Sky News quoted a security expert noting that once a patch is public, AI agents can study it and reproduce the attack far more easily. Content management systems, the category PHP sits beneath, made up nearly a third of the 495 known exploited vulnerabilities VulnCheck tracked. Put together: the bug count is rising sharply, the share that gets exploited hasn’t moved yet, and the window to patch is shrinking.

How do I protect my WordPress site right now?

1. 1. Update PHP immediately to a patched release. In most hosting panels this is under a “PHP version” or “PHP selector” setting. WordPress itself, your theme and your plugins need updating too.

1. 1. Ask your host. If you’re on shared hosting, confirm in writing when and whether PHP was patched.

1. 1. If you can’t patch, take the site offline or put it behind a web application firewall until you can, as EU and national agencies advised.

1. 1. Check for compromise. Look for unexpected file changes, new admin users and unusual outbound traffic, especially if the site was exposed before patching. A security plugin scan helps.

1. 1. Back up first. Take a full backup before updating, and store a copy off the server.

1. 1. Remove what you don’t use. Delete inactive plugins and themes, since each one adds code that can carry its own flaws.

1. 1. Shorten your patch cycle. Turn on automatic updates where it’s safe, and treat critical flaws as incidents, not backlog items.

Frequently asked questions

What is the PHP vulnerability that took websites offline?

It’s a pair of critical flaws in PHP, a programming language used by most identifiable websites. Both are rated 9.2 of 10 in severity, and officials warned they could allow remote code execution. Developers released patches on October 21, 2026.

Are AI-discovered vulnerabilities more dangerous than other bugs?

They tend to be more severe on average, but VulnCheck’s first-half 2026 data shows they are not exploited more often. Roughly 1.3% were exploited in the wild, matching the overall rate.

Is my WordPress site affected by the PHP flaws?

WordPress runs on PHP, so any site on an unpatched PHP version may be exposed. Update PHP through your host or server settings, then update WordPress and plugins.

How many vulnerabilities will be disclosed in 2026?

FIRST projects about 66,000 CVEs, a record. Part of the increase reflects AI-assisted discovery and part reflects expanded cataloging.

Will there be more outages like this?

Cloudflare’s CEO says he knows of additional severe vulnerabilities in other critical software now being patched and expects repeated alarms for a couple of years. Other experts are less sure that discovery will translate into successful attacks.

The bottom line

AI hasn’t made every bug an exploit. It has made finding bugs cheap, and that shifts the pressure onto the people who have to fix them. Outages like this week’s are the visible cost of a patching process that still runs at human speed.

Sources: Reuters explainer, Reuters factbox, AAP, Sky News, CyberScoop, Infosecurity Magazine, CSO Online, Help Net Security.