AI Just BROKE The Internet

Vídeo em Inglês, publicado pelo canal TheAIGRID.

About this content: The summary, key points and topics below are generated automatically from the video transcript. They reflect the content, opinions, claims and predictions presented in the video and do not represent a position, validation or fact-check by IA Dots.

Video summary

An AI model recently helped uncover two major security flaws in PHP, a software engine that powers a large percentage of websites globally. The discovery prompted international alerts, emergency patches, and temporary shutdowns of certain government services, highlighting both the capability of AI to find critical vulnerabilities and the risks associated with older, unmaintained internet infrastructure.

Key points

• AI models helped discover two critical security flaws rated 9.2 out of 10 in severity within the PHP engine.
• Major government agencies, including the NSA, FBI, and the UK's NCSC, issued urgent warnings and advisories prompting global response and system updates.
• A significant portion of older and abandoned websites running end-of-life PHP versions remain vulnerable to potential data leaks and exploitation.
• The discovery demonstrates the growing capability of AI systems to find deep-seated code vulnerabilities much faster than human teams.
• The video discusses the broader implications of powerful AI models potentially being used by malicious actors and the ongoing debate surrounding open-source AI restrictions.

Topics

Artificial IntelligenceCybersecurityPHP VulnerabilitiesOpen-Source SoftwareGlobal Security AlertsSoftware UpdatesData Leaks

Video transcript

Transcript from available captions; it may contain errors.

AI just broke the internet. In the last few days, an AI model helped uncover two hidden security flaws in a piece of software that runs an estimated 70% of all websites on Earth. And the reaction has been unlike anything I've seen. The FBI put out a critical alert. The NSA told organizations that if they can't fix their systems immediately, they should take them offline. The UK's National Cyber Security Center said the same thing. Governments in the Netherlands Finland France and Australia reportedly switched off some of their own services. And the prime minister of Japan personally went on X and asked people to take action that same night. All of this because AI found something that humans had missed for years. And the craziest part is that this was done with a model that is already considered old. So, in this video, I'm going to explain what actually happened in plain English, what it means for you and your data, why this is only the beginning, what happens when these AI systems get even smarter and end up in the wrong hands, and what we can actually do about it. Starting with point number one, which is what actually happened. So, let's keep this really simple because you do not need to be a programmer to understand this story. Almost every website you visit is built on top of some kind of engine that runs behind the scenes. You never see it, but it's there doing the work every time you load a page, log into an account, or buy something online. And one of the most popular engines in the world is called PHP. It's been around for about 30 years, and it powers a huge part of the internet. If you've ever visited a WordPress website, which has a massive share of blogs, news sites, and small business websites, you've used PHP. Online shops, forums, booking systems, school websites, local council websites, a lot of them run on PHP. OpenAI says it's used to run an estimated 70% of websites. So when something goes wrong with PHP, it doesn't go wrong for one company. It goes wrong for a huge chunk of the internet at the same time. Here's an easy way to picture it. Imagine that most of the houses in your country were built by the same builder using the same brand of lock on the front door. For years, everyone assumed those locks were solid. Then one day, someone discovers that every one of those locks has the same hidden weakness and that anyone who knows the trick can open them. Suddenly, it's not one house that's at risk. It's millions of houses all at once, all with the same problem. And the only fix is for every single homeowner to go out and change their lock. Some people will do it that same night, some people will do it next month, and some people are never going to hear about it at all. That in a nutshell is what happened to the internet this week. And that's exactly what happened here. Researchers working with AI models discovered two critical security flaws inside PHP itself. Not inside one website, but inside the engine that millions of websites share. And these weren't small bugs. The PHP team rated both of them a 9.2 out of 10 for severity. To put that in perspective, that's the kind of score that makes security teams drop everything they're doing. In simple terms, these flaws could let an attacker sitting anywhere in the world without a password, without an account, take control of a website's server. And once you control the server, you can potentially get to everything behind it. The files, the databases, and the information that people trusted that website with. Now, here's how the timeline played out. According to OpenAI, this all started back in August. Researchers at a security company called Whiz found the first version of the problem with the help of AI and reported it to the PHP team. Researchers at a company called Califf using OpenAI's model GPT 5.6 Soul also found one of the flaws. And OpenAI says its own team found an even more complete version of the bug in September. So this wasn't one lucky discovery. Multiple teams using AI kept finding the same hidden weaknesses. Then for about 2 months, OpenAI says it led a coalition of the people who maintain PHP, security researchers and security companies, to quietly prepare a fix before telling the world. And that's actually the normal, responsible way to handle something like this. You don't announce a giant hole in the internet before there's a way to close it because that just hands attackers a map. The fix was supposed to go out later this week, but then something went wrong. Details of the flaws leaked early and once that happened, the PHP team moved the release forward and pushed out the fix on October 21st, and this is where it went from a technical story to a global one. The PHP Foundation had already warned everyone the day before that a critical security release was coming. The NSA said that all organizations using PHP should be prepared and that if an immediate update wasn't possible, they should take their systems offline until they could be fixed. The FBI's cyber division put out an alert telling people to patch and hunt immediately, which basically means fix it now and then check whether someone already got in. The UK's NCSC said the same thing. And reports say that security firms saw attackers already starting to use these flaws within hours of the details getting out. And it wasn't just security agencies. Japan's Prime Minister Say Takayichi posted on X urging people to check whether their public websites use PHP and to prepare the fix, saying, "We have an urgent request for everyone to take action tonight." When a head of government is personally asking people to update a piece of website software, you know, this is not a normal week on the internet. Governments in the Netherlands Finland France and Australia reportedly took some of their own services offline temporarily while they applied the fix, and the developers warned that the update itself might take millions of websites offline for a short time while everyone scrambled to install it. Some organizations didn't wait around. The Dutch National Cyber Security Center took its own website offline as a precaution. Think about that for a second. The country's own cyber security agency switched off its website because it was safer than leaving it up. Cloudflare, one of the biggest companies that protects websites from attacks, rolled out emergency protections for all of its customers, including people on its free plan. And its leadership said they were already seeing early attacks emerging. So when I say AI just broke the internet, I mean that in a very real sense. For a day, a big part of the internet's defenses were scrambling at the same time because of something an AI system helped uncover. Which leads me to point number two, which is what this actually means for normal people like you and me. Because I know what a lot of people are thinking. I don't run a website. I don't know what PHP is. Why should I care? And the answer is that you don't need to run a website to be affected by this. You just need to use them. And every single one of us does every single day. Think about all the places on the internet that have your information. Your email address, your password, your home address, maybe your card details, your phone number, your order history. Now, think about how many of those places are big, well-funded companies with full security teams, and how many of them are small online shops, old forums you signed up to years ago, local businesses, community websites, hobby sites, or that one booking system you used once and forgot about. Those smaller sites are often the ones running older software run by people who don't have a security team and who may not even know that this happened. Let me give you a simple example. Imagine you bought a birthday present a few years ago from a small online shop. You made an account, typed in your name, your address, your email, and a password. Maybe you even saved your card. You haven't been back since. But that shop is still online running the same software it was running back then because the owner set it up once and never touched it again. Now, a floor like this one could let someone break into that shop's server and copy its entire customer list. Your name, your address, your email, and that old password. And if you've used that same password anywhere else, like your email or your social media, that's a door into the rest of your life. You never did anything wrong. You just used a website that nobody was looking after anymore. And this is the part of the story that really worried a lot of people. A post from International Cyber Digest summed it up with a really striking line. the day the internet broke and most of it is too old to fix. They pointed out that the PHP team is only fixing the versions that are still officially supported. Everything older than that is what's called end of life, which basically means it no longer gets updates. And according to their analysis of the top 7.2 million PHP websites, of the ones that reveal which version they run, 46.1% are running one of those endof life versions. And when that post spread, a user on X called Spore did some quick math and asked, "Wait, does this mean a full 1/3 of the internet is just permanently broken?" Now, I want to be careful here because that's a rough back of the napkin calculation, and it's not an official number. Some of those older systems can still be protected in other ways, and some companies offer their own fixes for older versions. But the point stands, there is a huge amount of the internet that is old, forgotten, and not being looked after by anyone. And those are exactly the sites that are most likely to stay exposed. Another account on X, Autism Capital, broke down why this is so alarming in a way that I think is really easy to understand. Their first point was that many websites that use PHP and hold sensitive information are simply abandoned. Nobody is going to upgrade them, which means they're likely to get hacked and leaked. Their second point was that fixing this requires the people running these websites to actually know about it. And as they put it, if you're on X following tech news, you're at the very tip of the spear. Most people don't know about this at all. Think about the person who runs a small online store, a local charity website, or a little community forum. They're not reading security alerts. They might not find out about this for weeks, months, or ever. So, what does that mean for you in practice? It means that over the next few weeks and months, there's a real chance we see a wave of data leaks from websites you may have forgotten you even used. old accounts, old passwords, old personal details. And when those leaks happen, they get used for scams. That's how you end up with fishing emails that know your name and your address. That's how you end up with people trying to log into your other accounts using an old password. So, even if you never touch a line of code in your life, this story can still reach you. Which brings me to point number three, which is the AI part of this story and why it's such a big deal. Because security bugs are found all the time. That's not new. What is new is how this one was found and what model found it. According to OpenAI, the researchers at Califf used GPT 5.6 Soul and Whiz says it used AI as well, including Google's Gemini model to help find the bug, understand it, and test the fix. In other words, this wasn't one person staring at code for months. AI systems were combing through one of the most widely used pieces of software on the planet and finding things that human experts had missed. And it's worth explaining why AI is so good at this, because it's not magic. Finding a security hole is a bit like proofreading a book that's millions of pages long, looking for one sentence that's slightly wrong in a way that only matters in very specific situations. Humans are good at this, but we get tired, we get bored, and we can only read so much in a day. AI doesn't get tired. It can read the whole book over and over again, checking every sentence against every situation it can think of. and it can run thousands of copies of itself at the same time. So things that might take a team of human experts months or years to notice, an AI system can sometimes spot in hours. That's incredibly useful for defenders, but it's also exactly what makes this technology so dangerous in the wrong hands. And here's the line that I think everyone needs to sit with. Nicholas Bamante posted on X that people don't realize this critical vulnerability was found using GPT 5.6 6 soul and that we've already moved on to GPT6 Astra and GPT 6.1. In his words, this is what older models can do. And he said he doesn't think the world is prepared for the sheer number of vulnerabilities that newer models will uncover or the cyber attacks that could follow. Let that sink in for a second. This is not the most powerful AI that exists today. This is a model from a generation that's already been replaced, and it still helped find one of the most serious security holes the internet has seen in years. So, if this is what the older models can do, the obvious question is, what can the newest ones do? And what will the next generation and the one after that be able to do? OpenAI described this as an example of something it calls the defender window. The idea is simple. When AI finds a security hole before the bad guys do, the good guys get a window of time to fix it before anyone can abuse it. And to be fair, that's exactly what was supposed to happen here. OpenAI says that to its knowledge, Frontier AI found these flaws ahead of attackers, giving defenders time to prepare. They called it one of the most impactful vulnerabilities in recent memory. And they said it marks a new phase where AI can find security bugs with internet scale impact. And on one level, that's genuinely good news. It means AI can be used as a kind of superpowered security guard, checking the locks on the internet's doors faster than any human team ever could. But the window only works if it stays closed to attackers. And in this case, the details leaked before the fix was even out. So even in the best case scenario, with a responsible company, a coordinated plan, and months of preparation, the window still slammed shut early. Which leads me to point number four, which is the fact that this is only the tip of the iceberg. Because OpenAI didn't just say, "We found this one bug." Andrew Curran highlighted a part of OpenAI's announcement on X where they said that as significant as these bugs are, they're among several significant vulnerabilities they've already found and are working to fix. And they said they expect similar findings to increase sharply in the coming months. In other words, there are more of these coming, several more that they already know about. and they expect the number to go up sharply. Now, I want you to think about what that means. For decades, finding a serious hole in a major piece of software was rare and difficult. It took teams of extremely skilled specialists a lot of time and effort. Now, we have AI systems that can scan through huge amounts of code around the clock without getting tired and spot patterns that humans miss. That means the number of serious flaws being discovered is about to go up, maybe dramatically. And every single one of those discoveries is a race. A race between the people trying to fix it and the people trying to use it. And the uncomfortable truth is that a lot of the internet was built a long time ago by people who never imagined that something could inspect every line of their code in a matter of hours. There's software running banks, hospitals, power grids, airports, and government systems that is decades old. A lot of it was written in a world where the main defense was that finding the flaws was just too hard and too slow. AI is removing that defense. The bugs were always there. What's changing is that they can now be found and they can be found fast. So when I say this is the tip of the iceberg, I really mean it. We are probably going to see more weeks like this one. More emergency patches, more alerts from government agencies, more websites going offline as a precaution, and more stories where AI is at the center of it. Which brings me to point number five, which is what happens when these systems get even smarter and end up in the wrong hands. Because right now, the story has a fairly happy ending, at least on paper. A responsible AI company working with security researchers and the people who maintain PHP found the problem first and organized a fix. But I want you to imagine a slightly different version of this story. Imagine the model that found this flaw wasn't being used by a security company that reports what it finds. Imagine it was being used by a criminal group or by a hostile government or by a single person who just wants to watch the world burn. In that version of the story, there's no two-month window. There's no coalition preparing a fix. There's no warning from the PHP Foundation. The first time anybody hears about the flaw is when websites start getting hacked, data starts leaking, and systems start going down. And the people defending those systems are starting from zero, trying to figure out what's happening while it's happening. And here's the part that really worries me. In security, there's a basic imbalance between attackers and defenders. A defender has to protect every single door, every single window, every single lock. An attacker only needs to find one way in. When finding those ways in was slow and expensive, that imbalance was manageable. But when AI can scan for weaknesses at the speed of a computer, that imbalance gets much worse because now the attacker can check every door, every window, and every lock at the same time. Now add the fact that the models keep getting smarter. Every new generation of AI is better at reading code, better at reasoning about how systems work, and better at planning multi-step tasks. If GPT 5.6 Soul could help find this, what does a model that's two or three generations ahead look like? A model that can not only find the flaw, but understand exactly how to use it, and maybe even carry out the attack by itself as an agent at scale across thousands of websites at once. That's not science fiction anymore. That's the direction this technology is clearly heading in. And this is where AI agents come in. An agent is an AI that doesn't just answer questions. It actually goes off and does tasks on its own. It can browse websites, run tools, write code, test that code, and keep going until the job is done. That's amazing when the job is building an app or booking a holiday. But imagine an agent whose job is to find vulnerable websites, break into them, and copy the data. And imagine running 10,000 of those agents at once. One attacker with enough computing power could do the work of an entire army of hackers. That's the kind of scenario that keeps security people up at night. And stories like this one make it feel a lot less hypothetical. And the people who want to use these tools for harm are not going to wait for permission. Criminal groups already run like businesses. Some governments already have full-time hacking teams. If they get access to AI systems that are as capable as the best ones in the world without any of the safety rules, the damage could be enormous. Not just leaked passwords, but hospitals locked out of their systems, payment systems going down, power and water infrastructure being targeted. The internet isn't just where we watch videos anymore. It's the plumbing of modern life. Which leads me to point number six, which is the question of open-source. And this is where I want to give you my honest opinion. So, first let me explain what open- source means in AI because it's really important here. When a company like OpenAI releases a model like ChatGpt, they keep the actual model on their own computers. You talk to it through their app or their website and they can monitor how it's being used, block certain requests, and shut down people who are abusing it. An open-source model, or more precisely, an open weights model is different. The company releases the model itself, so anyone can download it, run it on their own computers, change it, and remove whatever safety rules they want. And once it's out there, it's out there forever. You can't take it back. Now, to be clear, from what's been reported, this particular discovery was made with closed models, GPT 5.6 Soul and Google's Gemini, inside a responsible security program. So, this specific story isn't about an open- source model, but it raises the obvious question. What happens when open- source models reach the same level? Because they always catch up eventually. And when they do, anyone with a decent computer will be able to point a model like that at the internet and go hunting for holes. No monitoring, no safety rules, no one to report anything to, and no way to shut it off. And I'll be honest with you, this is something I've thought about a lot, and I've said it before on this channel. I've always believed that open source AI should be restricted beyond a certain level of capability. Not all open source because a lot of open source is fantastic and it's helped a huge number of people. But I personally believe that if AI really becomes as powerful as something like a nuclear weapon, then we simply don't want random people having it. We don't hand out nuclear materials to anyone who asks, no matter how many of them have good intentions, because it only takes one person with bad intentions to cause a catastrophe. And when you look at a story like this one, it's not hard to see how a powerful enough AI could become exactly that kind of tool for the digital world. Now, I know a lot of people disagree with me on this, and I respect that. There are really good arguments on the other side. People will say that open source lets defenders use the same tools as attackers, that it stops a few big companies from having all the power, and that it lets researchers around the world find and fix problems faster. And there's a real irony in this story, too, because PHP itself is open- source software. It's maintained by a relatively small group of people, and the entire internet relies on it. So, open- source is not the villain here. In many ways, it's the foundation the internet is built on. But I think there's a big difference between open- source software like a website engine and an open-source AI that is capable of finding and exploiting security holes across the entire internet on its own. One is a tool. The other is starting to look a lot more like a weapon. And I think this story is going to push a lot of governments to start asking that exact question. Should the most capable AI models be allowed to be released openly or should there be a line, a level of capability where we say this is too dangerous to hand to everyone? And if there is a line, what would it actually look like? One idea is testing before release. Before a powerful model is made public, independent experts would check how good it is at things like finding and exploiting security holes. And if it crosses a certain threshold, it can't be released openly. Another idea is licensing, where only approved organizations get access to the most capable models for sensitive tasks like security research. The same way that only certain labs are allowed to work with dangerous materials. None of this is simple and none of it is perfect. People will always try to get around rules, but I think it's a lot better than having no rules at all and finding out the hard way that a model was too dangerous only after it's already in everyone's hands. I'd genuinely love to know what you think about that. So, let me know in the comments. Which brings me to point number seven, which is the solutions and what's actually being done about this. Because I don't want this to be a video that just makes you scared and then leaves. There are real things happening and there are real things you can do. And the first thing to say is that the response to this was actually fast and in many ways it was impressive. Within a day of the leak, the fix was out. Governments had issued guidance. Big companies like Cloudflare had rolled out protections. And security teams around the world were working through the night. That doesn't happen by accident. It happens because people prepared. Open AAI says this was all part of an initiative it calls patch the planet. The idea is to use AI to find security holes in the software the whole world depends on and then work with the people who maintain that software to fix those holes before attackers find them. And as part of that, they've proposed a step-by-step approach for how the world should respond to AI discovered bugs. In simple terms, it goes like this. Fix the problem at the source first. Give the organizations that will be affected time to prepare. Bring in government partners early. get the updates ready for all the products built on top of that software and then publish clear guidance for everyone else. They've also said they're putting up $1 billion in subsidized access to their security tools for defenders, especially organizations that don't have the money for big security teams. And they've released a tool to help people check whether they're running a vulnerable version of PHP. Now, you can be a bit cynical about that and say this is an AI company trying to clean up a mess that AI made. And honestly, that's a fair point to raise, but I do think the basic idea is right. If AI is going to find all these holes anyway, we absolutely want the good guys to find them first. The worst possible outcome is a world where only the attackers are using AI to look for weaknesses. So, what can you actually do as a normal person? The first thing is the boring stuff that genuinely works. Keep your devices and your apps updated because updates are how these fixes reach you. Use a different password for every important account, ideally with a password manager so that if one old website gets leaked, it doesn't unlock everything else. Turn on two-factor authentication wherever you can, especially for your email and your bank. And be extra careful over the next few months with emails or messages that seem to know a lot about you because that's exactly what leaked data gets used for. And if you run a website or you know someone who does, this is the moment to check. If the site is built on WordPress or anything else that uses PHP, make sure it's up to-date or ask your hosting company whether they've applied the fix. If you have an old website sitting around that nobody looks after anymore, honestly, it might be time to either update it properly or take it down. Those forgotten websites are exactly where the problems are going to show up. And I think the companies that sit in the middle of all of this have a big role to play, too. Hosting companies, the businesses that actually run websites for people, can push these updates out automatically so that small website owners are protected even if they never read a security alert. Companies like Cloudflare showed this week that it's possible to put a protective layer in front of millions of websites at once, even for free customers. And software makers can design their products so that security updates happen by default instead of relying on busy people to remember to click a button. The more we can take the responsibility off the shoulders of the person running a little shop website, the safer everyone becomes. Because the honest truth is that the internet is only as strong as its weakest, most forgotten corners. And on the bigger picture, I think this needs to push governments and companies to take the security of the internet's foundations a lot more seriously. A huge amount of the world runs on open-source software that is maintained by small teams of volunteers, often with very little funding. If AI is going to put that software under a microscope, then the people looking after it need real support, real funding, and real help. Otherwise, we're going to keep having weeks like this one. Which leads me to point number eight, which is my honest take on all of this. And I'll be honest with you, this is not an AI story that I'm happy about. I make videos about AI every single day, and a lot of the time, I'm genuinely excited about what this technology can do. Curing diseases, speeding up science, helping people learn, making work easier. But this one is different. This is a story where AI showed us very clearly how much damage it could do if it ends up being used the wrong way. And it showed us how fragile the internet really is underneath. Because the internet isn't just a place where we scroll and watch videos. It's how we bank, how we talk to our families, how hospitals share records, how businesses run, how governments deliver services, and how most of the modern world works. When something threatens the foundations of the internet, it threatens almost everything. And we really do want the internet to be a safe place because so much of our lives now depend on it. So I see this as a warning shot, an early one. This time the people who found the problem were the good guys. They had a plan and the world had a little bit of warning, even if it was cut short by a leak. But this was done with a model that is already a generation old. The next models are smarter. the models after that will be smarter again and eventually models with these kinds of abilities will be much more widely available. The question is whether we use this warning to get ready or whether we wait for the version of this story where there is no warning at all. I think it's going to be really interesting to see how things change after this. Do governments start treating the most powerful AI models like they treat other dangerous technology? Do we see new rules around open-source AI? Do AI companies start running these kinds of security programs as standard before every new model release? And does the world finally put real money into protecting the software that everything runs on? I don't think anybody has all of the answers yet, but I do think this week is going to be remembered as a turning point, the moment it became obvious that AI is now powerful enough to shake the internet itself. So, what should you actually watch for over the next few weeks? I think there are three things. The first is the follow-up announcements. OpenAI has already said it has several more significant vulnerabilities that it's working to fix. So, pay attention when those come out, and pay attention to which pieces of software they're in. If the next one is in something even more widespread or something that runs critical infrastructure, this story gets a lot bigger. The second thing to watch is databach notifications. If you get an email from a website telling you that your information may have been exposed, don't ignore it. change that password straight away and change it anywhere else you've used it. Over the coming months, I think a lot of those emails are going to be connected to this week, even if they never say so. And the third thing to watch is what governments do next. We've already seen agencies in the United States, the United Kingdom, Japan, and across Europe react within hours. The question is whether that turns into new rules, new funding for the software the internet depends on, and new requirements for how AI companies test and release their most capable models. Because if this week has shown us anything, it's that the gap between an AI discovering something and the whole world feeling the impact is now measured in days, not years. And the decisions that get made right now, while this is still fresh in everyone's minds, are probably going to shape how safe the internet is for the next decade. So now I really want to hear from you. Do you think this is a sign that AI is helping make the internet safer by finding these problems before the bad guys do? Or do you think this is the start of something much more dangerous? And what do you think about open-source AI? Should the most powerful models be restricted or should everyone have access to them? Let me know down in the comments because I genuinely read them and this is one of the most important conversations we can be having right now. And if you found this video useful, make sure to like and subscribe because things in AI are moving faster than ever and I'll be here to break all of it down for you. Thanks for watching and I'll see you in the next one.

Assistir ao vídeo original no YouTube

Assuntos: Agentes de IA, Assistente pessoal, AGI. Publicado no YouTube em 2026-10-21.

Seleção automática por assunto e idioma. O vídeo pertence ao canal de origem.