The BaseNewsAxios
Black October: why bugs discovered by OpenAI tech are creating a cyber emergency
Axios reports that flaws in PHP, which it says runs millions of websites, were found with help from OpenAI technology, and that patches released on Oct. 21 sent governments and companies offline briefly. In a Bloomberg Tech interview, OpenAI's Greg Brockman and Cloudflare's Matthew Prince describe the discovery and the attacks since.
Why it matters
The same thing, for different readers.
What it means for you
Websites built on PHP may have been exposed for years; Cloudflare's CEO says anyone running PHP should install the free update now.
For lawmakers
OpenAI's Brockman asks what societal process should keep the internet patched as AI finds flaws faster, and cites court-ordered botnet clean-ups as a precedent.
For researchers
OpenAI says its internal model found the more complete version autonomously, a month after a security researcher using its models found an earlier version.
The question it raises
Who may scan for and remotely patch other people's vulnerable systems, and who decides, is left open by OpenAI's Brockman.
In their own words
Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.
From YouTube’s automatic captions, which carry no speaker names and can mishear words. Where the speaker is known only from context, the quotation says so.
“It wasn't that AI created the bug. AI found the bug that was there, and it's incredibly important that we've now found it, fixed it, and the software is significantly more secure because of the work that OpenAI did.”
“Literally, we're seeing millions of attempted, attacks using this flaw, now across all of our network, you know, every single minute of every single day.”
“We set up an environment, and we we took our most capable model with a lot of compute behind it, and that that autonomously was able to find the full exploit.”
“we're in this world where there's what we call a defender's window, where frontier models are ahead of what's broadly available.”
“believe that attackers are going to start using models broadly to try to exploit these flaws. We are monitoring on our side watching for it”
The record
- Questions
- How is AI used in attacks, defence and war? · Are AI companies putting stronger safeguards into practice?
- People
- Greg Brockman (Speaks, President, OpenAI) · Matthew Prince (Speaks, CEO, Cloudflare) · Ed Ludlow (Speaks) · Herb Scribner (Wrote it)
- Also covered by
- Bloomberg Tech · Bloomberg Television · NBC News
- What we read
- We could read only part of the source.
- Found by
- The Radar, run of October 23, 2026, via
axios(tier 2: a major outlet’s own reporting) - Cite this
- Axios, “Black October: why bugs discovered by OpenAI tech are creating a cyber emergency”, October 22, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/axios-2026-10-22-openai-php-flaw-black-october