Technology & Security
NewsOnScale Staff
October 22, 2026
Two cybersecurity stories broke this week that together paint a picture of digital infrastructure more fragile than most Americans realize.
The PHP vulnerability
Security researchers used frontier AI models to discover a critical flaw in PHP — the programming language that powers up to 70% of all websites on the internet. WordPress runs on PHP. Government portals run on PHP. News organizations, banks, and public services around the world run on PHP.
The flaw is not in one application. It is in the language itself.
Details of the vulnerability leaked on social media before a patch was ready. The PHP Foundation was forced to rush out emergency alerts while governments and public institutions had to make an impossible choice — keep systems online and vulnerable, or take them offline and go dark.
The Dutch government went offline. The lower house of the Dutch parliament went offline. Edinburgh Council went offline. Parts of the BBC went offline.
This is what happens when AI finds a vulnerability in foundational infrastructure before defenders can respond. The attack surface is not one company or one application. It is 70% of the web simultaneously.
The question that follows is uncomfortable: if AI can find this vulnerability, so can a hostile nation state, a criminal organization, or an autonomous agent deployed at scale. The same capability that made the discovery possible makes the exploitation possible. The researcher and the attacker now have access to the same tools.
The Staples gift card theft
Separately, unsealed court records revealed that a China-based organized crime group hacked into Staples' internal systems and stole more than $5 million in gift cards. The group then conducted a nationwide shopping spree at Target, Sephora, and other major retailers — converting digital theft into physical goods across the country.
This is not a sophisticated state-sponsored attack on critical infrastructure. This is organized crime using digital tools for retail theft at scale. The gap between a nation state cyber operation and a criminal organization running a gift card scheme has narrowed to the point where both are happening in the same news cycle.
What these stories share
Both stories are about the same underlying reality. Digital infrastructure was built for a world where attacks were slow, expensive, and required significant expertise. AI has changed all three of those conditions simultaneously. Attacks are faster. They are cheaper. And the expertise required to find and exploit vulnerabilities is now accessible to anyone with access to a frontier AI model.
Government websites went dark this week because AI found a bug in a programming language. A crime group stole $5 million from a retailer because digital systems that handle gift card inventory were not adequately secured.
The patch for PHP is coming. The Staples investigation is ongoing. The underlying problem — that digital infrastructure was not built for the speed and scale of AI-assisted attacks — does not have a patch.
NewsOnScale is owned by AMILLI AI, Corp., founded by JJ Johnson.