Two separate incidents last week highlighted the importance of understanding critical technology dependencies across your business. AI is changing the speed at which legacy software vulnerabilities can quickly become viable exploits with real-world impact on your users and customers.
Google Cloud outage, Tuesday 20th October
Google’s preliminary report attributes the London incident to a power interruption compounded by failed backup-generator controls. The main disruption lasted six hours, with effects spreading into other availability zones. Revolut’s payments, transfers and withdrawals were affected, with disruption continuing after Google’s main recovery.
PHP2Shell, Wednesday 21st October
Two critical vulnerabilities in PHP, software powering many websites and applications, could allow attackers without login credentials to execute malicious code and access sensitive information. Emergency patches were released and organisations took websites offline as a precaution.
Why the AI aspect matters
Security researchers at Calif used OpenAI’s ChatGPT to identify a critical flaw, while Wiz independently used AI to discover vulnerabilities, develop working exploits and help validate fixes. Wiz reports that AI substantially reduced the specialist effort needed to turn complex weaknesses into practical exploits and adapt them across different applications.
The history is significant: signs of one underlying problem had been identified in 2024, but technical trade-offs, limited resources and decision-making delays stalled remediation.
Your legacy stack demands renewed scrutiny as exploitation capabilities improve
AI offers a defensive opportunity, but faster discovery needs to be matched by the engineering capacity and authority to deploy fixes quickly.
Four considerations for executive leadership.
Exposure
Which critical services and suppliers depend on the affected infrastructure or software? What revenue, customer and operational impact would their loss create?
Protection
Can teams evidence patching and checks for prior compromise, including assessment of PHP’s 23 October follow-up guidance on residual exposure?
Response speed
Are you using AI to strengthen security testing and triage, with expert oversight and a process that turns findings into validated fixes?
Recovery and authority
Have you tested fallback arrangements, transaction reconciliation and customer communications, as well as agreeing on your principal decision-makers in time-sensitive crises like this?