
So. The above graph is plotting the number of CVEs (Computer Vulnerabilities/Expoits) that have ever been discovered. It’s sourced from the Electronic Frontier Foundation, who’s been tracking CVE discoveries since the mid 90s. Vulnerabilities have… exploded. In 2026. Literally 3% of ALL CVEs WERE DISCOVERED IN THE LAST THIRTY DAYS, AND WE’RE ON TRACK FOR 1/4th OF ALL OF THEM BEING DISCOVERED IN 2026. You… can probably guess why. It’s AI.
AI has become insanely good at trawling code and finding where it breaks. People are literally sending Claude to break into some shit and when it does they submit the bug report as a CVE. It’s… exponential. And in the last week, we got a taste of what’s possible with the PHP vulnerability
“PHP” is a very fancy acronym to describe The Entire Engine That Makes Webpages Load Correctly. Last week, AI discovered a vulnerability affecting 70% of PHP users. IE, the entire web. The vulnerability allowed you to execute unauthorized code on any website with the vulnerability. This was so deeply severe and concerning literally 70% of the internet went offline. Like. The NSA told the entire internet “shut the fuck down until a patch goes live you are fucked you are so fucked oh my god”
And HERE’S the thing. Ao3 is a RoR site. It doesn’t use PHP. But a week after 70% of the internet goes offline due to a bug, Ao3 is targeted by a security incident. I think someone found a new CVE using AI, and the 2-4 week timeline is because they’re completely unsure how to patch it because it’s never been seen before. They might still be trying to figure out how the attacker even got in.
We’ve already found RoR CVEs using AI. CVE-2026-66066 is the big one. This is insanely likely. … and at the exponential rate this is going, soon, it’s gonna be much more serious shit than Ao3. 70% of the internet went offline literally last week. we’ve already seen it happen. it’s just gonna happen faster as the ais get better