---
title: "The AI-Fueled Security Nightmare is Here"
description: "There's been a recent onslaught of vulnerability disclosures, critical exploits, and compromised systems. This is the new normal."
kind: "article"
section: "Society"
author: "Josh Alley"
author_url: "https://hastalavista.ai/authors/alley"
published: "2026-10-22T14:26:15.243Z"
updated: "2026-10-22T16:10:59.289Z"
canonical: "https://hastalavista.ai/society/the-ai-fueled-security-nightmare-is-here"
---

# The AI-Fueled Security Nightmare is Here

*There's been a recent onslaught of vulnerability disclosures, critical exploits, and compromised systems. This is the new normal.*

By [Josh Alley](https://hastalavista.ai/authors/alley) · October 22, 2026

AI is much better & faster than humans at hacking. As the models continue to become more capable, the impacts are exponential.

Yesterday, the research team at Wiz disclosed multiple critical vulnerabilities in PHP, a programming language that powers popular website software like WordPress, Joomla, Drupal, Wikipedia, and more. The vulnerabilities can lead to remote code execution, which is basically the worst it can get. PHP powers around 70% of all websites in the world, and after the news broke, the tech world raced to both patch and exploit affected servers.

Wiz isn't shy about crediting AI, because AI is really, really good at this type of work. The bugs that allowed the exploit had been dormant in every PHP version for the past decade. Earlier this year, AI-driven research found multiple decades old bugs in OpenBSD, Linux, FreeBSD, Squid, and other software that powers much of the invisible technology we depend on for the internet, telecommunications, and critical infrastructure.

> **Related:** [PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog](https://www.wiz.io/blog/php2shell-php-rce) (wiz.io)
>
> Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.

The models that are finding these bugs are now more widely available to more people. And the open source models continue to make progress catching up to the frontier. As more and more people get access to these tools, there will be more and more vulnerabilities discovered and exploited. Automated systems are trivial to build that attempt to exploit known vulnerabilities, and discover new ones, en masse across giant swaths of the internet.

There will be more vulnerabilities discovered at this scale. And, most likely, there's a great number of vulnerabilities already discovered that are being exploited in secret. Bad actors don't disclose their findings, they exploit them first.

> **Related:** [CVE (@CVEnew) on X](https://x.com/CVEnew) (X (formerly Twitter))
>
> Official account maintained by the CVE Program to notify the community of new CVE IDs.

Lots of software includes other software, just like hardware includes other hardware. For example, a Honda car may re-use the same turning signal component across multiple car models, even if the outside of the car and the engine are different. Reusable components are an efficiency gain.

And just like a turn signal or airbag component could have a design flaw that leads to failure that affects many different car models, a software component being used inside another piece of software could similarly fail if the component is flawed.

That's what happened to GitLab. They offer self-hosted git repository software, which is a tool that a software company would use to manage their code. An exploit was found in GitLab versions stretching back over a decade that allows for total compromise, because a component GitLab bundled had the flaw.

> **Related:** [Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases](https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html) (The Hacker News)
>
> GitLab fixes CVE-2026-110264, a critical flaw that could allow unauthenticated code execution on self-managed versions dating back to 7.0.

Humans have many undiscovered critical flaws in our software. AI will continue to discover & exploit them at record speed. This is the new normal.

> **Related:** [pwn.watch · live security incidents](https://pwn.watch/) (pwn.watch)
>
> 36 live incidents (15 critical). Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them.

> **Related:** [Bill Gates Thinks AI Makes Nukes Look Like Nothing. He's Right.](https://hastalavista.ai/society/bill-gates-thinks-ai-makes-nukes-look-like-nothing-hes-right)
>
> On The Ezra Klein Show, Bill Gates argues AI poses risks greater than nuclear weapons, a warning that carries weight coming from one of the technology industry's most influential figures.
>
> *Human take:* Bill Gates isn't a dumb person, and he has access to the best available, privileged information. He's also correct in portraying the risks of AI.