Microsoft CEO Warns AI Is Accelerating the Discovery and Exploitation of Critical Software Flaws

Microsoft CEO Satya Nadella has renewed attention on the cybersecurity risks associated with artificial intelligence following the discovery of critical vulnerabilities in PHP, a programming language used by millions of websites. The security flaws, publicly disclosed on October 21, 2026, exposed weaknesses that had remained hidden in the software for years. The incident prompted organisations and government agencies to review their systems, with some temporarily taking websites offline while security updates were prepared or installed. The discovery has become an important example of how AI-assisted research can uncover vulnerabilities with potentially widespread consequences. It also highlights a growing challenge for the technology industry: security teams must respond quickly as AI tools make it easier to identify weaknesses in widely used software.

The vulnerabilities were discovered through work involving cybersecurity researchers and AI systems. Security firm Calif reported finding one of the flaws with assistance from an OpenAI model, while Alphabet-owned cybersecurity company Wiz independently identified vulnerabilities using its own tools alongside advanced AI models. The findings were coordinated with PHP maintainers and other technology companies before public disclosure. PHP is particularly important because it powers server-side functionality for websites and is used by major content-management systems, including WordPress, Drupal and Joomla. According to cybersecurity reporting, the flaws could allow attackers to execute malicious code on vulnerable servers, potentially exposing files, databases and other sensitive information.

The incident demonstrates how AI can change the economics of cybersecurity research. Traditionally, identifying a serious software vulnerability and developing a reliable method to exploit it could require considerable technical expertise and time. AI systems can help researchers analyse complex code, test possible attack paths and identify combinations of weaknesses that might otherwise be overlooked. In this case, researchers said the vulnerabilities were difficult to exploit because they required a complicated sequence of technical steps. AI-assisted analysis helped make that investigation more manageable. However, the same capabilities could also help malicious actors reverse-engineer security patches and adapt attacks to different server configurations. Security experts therefore warn that AI can strengthen both cyber defence and offensive capabilities, making the period between discovering a flaw and exploiting it potentially much shorter.

The discovery prompted an international response as authorities urged organisations using affected PHP versions to install the relevant security updates immediately. The US National Security Agency warned that organisations unable to patch vulnerable systems should consider taking them offline until they could be secured. Several government and public-service websites in Europe temporarily suspended operations as administrators worked to protect their infrastructure. Reuters also reported that Amazon detected attempted exploitation against a decoy system before the vulnerabilities were publicly disclosed, although the company said it was unclear whether those attempts would have succeeded against real websites. After disclosure, security teams faced additional pressure because attackers could study the published fixes to develop methods targeting systems that had not yet been updated.

For Microsoft and other technology companies, the episode reinforces the need to build security into AI development and deployment rather than treating it as a separate concern. Nadella has argued that organisations should not rely entirely on AI providers’ assurances when their agents receive access to sensitive data and important business systems. Microsoft has been developing security features designed to monitor AI agents, limit their permissions and detect potentially dangerous actions. The PHP incident adds urgency to these efforts by showing how rapidly AI-assisted vulnerability research can affect internet infrastructure. Experts recommend that organisations maintain updated software, monitor suspicious activity, restrict unnecessary system permissions and establish clear procedures for responding to security advisories. As AI becomes more capable, the central challenge will be ensuring that defenders can use these tools to strengthen digital security faster than attackers can use them to undermine it.