Is the internet still safe?

A week of AI-discovered vulnerabilities. On 20 October browser security teams received eight private security keys issued by Indian authority eMudhra that should have been 116 digits long but were no longer than three (one was simply “4”); eMudhra said they were “possibly” found using AI. On 21 October two PHP vulnerabilities, affecting software that underpins tens of millions of web applications, were disclosed; governments told affected organisations to go offline until a patch, several European government websites went dark, and exploit details leaked more than 12 hours before the fix. The PHP flaw was found independently by two members of an OpenAI-led AI cyber-defence consortium. By 22 October GitLab had patched a flaw spanning 12 years of releases (severity 10/10) and Oracle a Java flaw rated 9.1, which the article says AI probably found too. The Economist argues that publishing a fix now starts an exploitation clock: an accidentally released video and a security firm publishing its fix six hours early let attackers use AI to reverse-engineer the PHP bug, so defenders must learn to spread fixes without tipping off attackers. Attribution to AI is partly hedged (“possibly”, “probably”).