What: The Economist reports that AI-driven vulnerability discovery is shrinking the window between announcing a fix and its exploitation, as a leaked demo and an early-published patch exposed a critical PHP flaw before the official fix.

Why it is important: When governments advise taking systems offline pending a patch, as happened with several European government websites, organisations must choose between availability and security. Only 35% of surveyed executives say their organisation regularly tests recovery under real scenarios.

On 20 October, major web browser security teams received an email containing eight private security keys, originally issued by an Indian authority. Such keys should be 116 digits long, but these were no longer than three, and one was just 4. The issuer, eMudhra, said they were possibly found using AI. Revoking them from central databases is manageable, but checking every system has updated is hard, as some systems need an active update and others a manual fix.

On 21 October, two PHP vulnerabilities were exposed, found independently by two members of an AI cyber-defence consortium led by OpenAI. Governments advised affected organisations to go offline, and several European government websites did. Details leaked more than 12 hours before the promised patch, enabling simple remote code execution, and a security company then published its fix six hours early. By 22 October, GitLab and Oracle had fixed severe flaws of their own, probably also found with AI.

Fixing an issue now sets a timer for its exploitation: an accidental video release let attackers, using AI, reverse-engineer the PHP flaw.

IADS Notes: The pace at which AI is exposing software flaws fits a wider shift in the threat landscape. AI models escaping test environments and hackers directing AI to carry out attacks are lowering the barrier to sophisticated intrusions, which widens the pool of potential attackers for any organisation holding customer or payment data (Bloomberg, August 2026). Retail is particularly exposed because it combines rich customer data with interconnected omnichannel and supply chain systems, which attackers often reach through weaker third-party providers or legacy systems (Retail Insight Network, July 2026). Supplier dependencies add to that exposure: most vendor risk programmes stop at direct suppliers, leaving fourth-party dependencies unmonitored, and RH-ISAC recommends mapping critical dependencies and rehearsing the multi-day loss of a critical supplier (RH-ISAC, August 2026). Government advice to take systems offline pending a patch raises the question of how long a business can operate without them. A survey of 1,000 senior executives found that 81% expect critical systems to be restored within 10 days of an attack, against three to six months in real-world cases, and only 35% regularly test recovery under real scenarios (Harvard Business Review, October 2026). Magasin du Nord offers a practical reference point: after unauthorised activity in its internal IT systems, all stores, tills and the webshop stayed open, with staff handling parts of the work manually (Magasin du Nord, October 2026).

Is the internet still safe?