The Internet Didn't Catch Fire. But AI Just Exposed Its Cracks.

The third chapter in a developing story about agentic AI, cybersecurity, and digital trust

Imagine waking up to discover that the locks protecting millions of digital doors may not be as secure as we believed. Some doors lead to ordinary websites. Others lead to government services, customer records, business platforms, and financial information.

That is the uncomfortable picture emerging from several cybersecurity developments this week. The internet has not collapsed, and there is no reason for everyone to abandon it. But the events of October 2026 deserve our attention for a much more important reason: artificial intelligence is changing the speed at which weaknesses in our digital world can be discovered, exploited, and repaired.

From an early warning to a real-world test

For me, this story did not begin with this week's security alerts.

In June 2025, I published “From Chatbots to Cyber-Worms: Why the Age of Agentic AI Demands Radical Rethinking of Cybersecurity” . I explored how AI systems were evolving from tools that simply answer questions into agents capable of taking actions—and how that shift could introduce threats such as self-propagating malicious instructions, manipulation of AI assistants, and automated discovery of previously unknown software weaknesses.

At the time, much of the evidence came from research demonstrations. The risks were credible, but their wider implications were still emerging.

Ten months later, in April 2026, I returned to the subject in “10 Months Ago, I Asked a Question About Cybersecurity and Agentic AI… Today, Anthropic’s Project Glasswing Announcement Gives Us the Answer.” . Anthropic's Project Glasswing, involving its Claude Mythos Preview model, offered a more concrete illustration of how advanced AI could discover serious vulnerabilities at extraordinary speed. My central concern was no longer just what AI might eventually do, but how quickly cybersecurity would need to adapt.

Now, in October 2026, several alarming developments are putting that broader question into practical focus. They are separate incidents, and not all of them were caused by AI . Together, however, they reveal how fragile parts of our digital infrastructure remain—and why the growing speed of AI-assisted discovery and attack matters so much.

An old weakness, a new level of urgency

On October 21, the developers of PHP, one of the technologies behind a large proportion of websites, released urgent fixes for two severe security flaws. W3Techs estimates that PHP is used by around 69% of websites whose server-side programming language it can identify. That is not the same as saying 69% of the entire internet is vulnerable, but it explains why the warnings spread so quickly.

Under certain conditions, the flaws could allow an attacker to take control of a vulnerable website's underlying server without first logging in. The affected technology sits behind popular publishing and website systems, including WordPress. In other words, this was not a problem confined to one website or one company.

The PHP Foundation released fixes on October 21 and called for immediate updates. In the Netherlands, some official websites were temporarily taken offline as a precaution. Cybersecurity authorities in the United States, the United Kingdom, and the European Union issued urgent guidance to organizations running affected systems.

It was a serious response to a serious risk. It was not, however, evidence that every website had been hacked.

The troubling story of a digital key

At nearly the same time, a separate incident raised questions about one of the foundations of online trust.

When we visit a secure website, our browser relies on a system of digital certificates to help verify that the site is genuine. We rarely think about this invisible network of trust. We simply expect it to work.

Researchers discovered that eight certificate-authority keys associated with eMudhra, a digital-trust provider, had been generated with dangerously weak randomness. To put the issue in everyday terms, digital keys that should have been extraordinarily difficult to predict were instead drawn from a tiny range of possibilities. Some reporting referred to a key with the value four .

This was not an ordinary password set to “4,” nor does it mean that online banking passwords worldwide were exposed. The risk was more specific: in circumstances where an attacker could intercept an insecurely protected connection, such keys might enable convincing impersonation of a legitimate website.

Google and Mozilla moved quickly to block the affected certificates. eMudhra said none of the eight affected authorities had issued end-user certificates, and that its systems had not been breached. The investigation and protective work were nevertheless a reminder that the web depends on many behind-the-scenes organizations getting the basics right.

Trust on the internet is not just about how secure one company is. It also depends on the reliability of the companies that everyone else trusts.

When cyberattacks begin to scale with AI

The third story may prove the most consequential over time.

On October 21, The Information reported research from cybersecurity company Straiker describing a criminal group using AI agents built around models such as Claude, Grok, and Kimi to automate attacks against more than 400 financial targets in Latin America.

That figure refers to reported targets, including banks and payment services. It does not establish that 400 banks were successfully breached. Still, the allegations are significant.

Traditionally, sophisticated cyberattacks required people to investigate systems, adapt their methods, and work through many obstacles. AI can increasingly assist with those repetitive tasks at speed. One attacker may be able to attempt what previously required a much larger team.

The worrying question is not whether AI invented cybercrime. It did not. The question is what happens when cybercrime becomes faster, cheaper, and easier to repeat.

The same technology is also helping defenders

There is an encouraging side to this story.

The PHP flaws were brought into focus through work involving human researchers and advanced AI systems. OpenAI's Patch the Planet initiative connected security researchers, software maintainers, and infrastructure providers to coordinate fixes before the vulnerabilities were publicly disclosed. Other researchers, including Wiz, independently found and reported serious issues.

The PHP Foundation acknowledged that signs of one underlying problem had surfaced as far back as 2024. But recognizing a possible weakness is not the same as demonstrating how a real attacker could exploit it or designing a safe fix for millions of systems. Limited resources and difficult decisions slowed progress.

AI helped researchers explore possibilities that would have been exceptionally time-consuming to investigate manually. Human developers, meanwhile, still had to validate findings, design the fixes, and coordinate a difficult release.

This is the race I described in my April article about Project Glasswing, now illustrated by more concrete developments. AI can help attackers find open doors—but it can also help defenders discover and close them first.

What matters is whether the defenders can move faster—and whether their protection extends beyond the world's largest technology companies.

The real vulnerability may be neglect

Not every organization has a dedicated security team. Thousands of websites are maintained by small companies, schools, nonprofits, and public agencies. Some run software that has not been updated in years. Others rely on outside providers without knowing exactly who is responsible for security.

A flaw affecting widely used software can therefore become a problem of organizational readiness as much as technology. A strong system that is promptly maintained can be safer than an expensive platform everyone assumes somebody else is watching.

For business leaders, this week's events should prompt straightforward questions. Do we know which critical systems we depend on? Who is responsible for updates? How quickly can our suppliers respond to a serious vulnerability? Can we keep essential services running safely when a component must be taken offline?

These are not simply questions for the IT department. They are questions of business continuity, customer confidence, procurement, and leadership.

What should ordinary internet users do?

There is no official basis for telling everyone to stop using the internet for several days. The urgent advice to disconnect systems has primarily been directed at operators of vulnerable websites and services , not the public at large.

For individuals, practical habits remain the best response: keep browsers, phones, and computers updated; use a different strong password for each important account; enable multifactor authentication, preferably through an authenticator app or security key; avoid suspicious messages and unexpected login links; and pay attention to unusual activity on financial accounts.

For website owners, the priority is more immediate: confirm whether their systems use affected PHP versions, work with their hosting provider to install the official fixes, and verify that the updates are actually running. A routine WordPress content update alone does not fix the underlying PHP problem.

Fear is not a security strategy. Preparation is.

The bigger lesson: trust must become continuous

For decades, much of our digital confidence has rested on an assumption: if a website worked yesterday, and a trusted company built the software behind it, it is probably safe today.

AI is challenging that assumption. It can uncover old weaknesses in new ways. It can help malicious actors move with unprecedented speed. Yet it can also give security professionals tools to protect systems that once seemed too complex to examine thoroughly.

The internet did not catch fire this week. What happened was more revealing: we saw how much of modern life depends on invisible technical foundations, and how quickly advanced AI can test their strength.

Looking back across these three articles, I see a progression: a warning in June 2025, a major demonstration of AI capability in April 2026, and an urgent test of digital readiness in October 2026. That does not mean every event was predictable. It means the central challenge has become harder to ignore: our ability to defend digital systems must keep pace with the ability to find their weaknesses.

The question for governments, businesses, and technology providers is no longer simply, “Are we secure?”

It is: “Can we discover, respond, and adapt faster than the threats around us?”

In the age of AI, digital trust will not be something we establish once and assume forever. It will be something we must continuously earn.

#ArtificialIntelligence #AgenticAI #Cybersecurity #AICybersecurity #DigitalTrust #CyberResilience #AISecurity #DigitalTransformation #RiskManagement

---

Originally published in the VerbionPulse newsletter on LinkedIn: The Internet Didn't Catch Fire. But AI Just Exposed Its Cracks..