AI-found vulnerabilities and maintainers: Sam Altman says we can't 'just patch all the bugs,' Cloudflare's CEO expects weekly alarms, and the PHP Foundation says it's under-funded

AI-found vulnerabilities, and the security maintainers who have to fix them, were the theme of three sets of remarks between October 21 and October 24, 2026. OpenAI CEO Sam Altman told Stanford business students that he no longer thinks "we're going to be able to just patch all the bugs." Cloudflare CEO Matthew Prince told Reuters to expect "a couple years where every single week it's going to feel like the sky is falling." And the PHP Foundation, whose language was hit by the AI-assisted PHP2Shell flaws, told Reuters it runs on one full-time employee. This analysis looks at what each said, what the numbers support, and what it means for the people who write patches.

This analysis is based on Stanford GSB's video listing, Gizmodo's October 23 report on Altman's remarks, Reuters reports of October 23 and 24 (read through the Honolulu Star-Advertiser and Investing.com, which carry them), the PHP Foundation's own posts, VulnCheck's first-half 2026 report and October 22 blog post, the Sovereign Tech Agency's project page and the Linux Foundation's March 2026 grant announcement, checked October 26, 2026. It also draws on 9to5AI's October coverage of the bugs themselves.

The short version

• Altman: "I no longer think we're going to be able to just patch all the bugs." His answer is to "completely switch the defense model to using the same technology," Gizmodo reported.
• Prince: expects weekly alarms for "a couple years" and says he knows of "a bunch of additional severe vulnerabilities that are present in other pieces of critical software," per Reuters.
• PHP Foundation: one full-time staff member and 14 mostly part-time contractors, unpaid board members, and nearly twice as many proposed code changes as a year earlier, Barron told Reuters.
• The data: VulnCheck counted 1,061 vulnerabilities attributed to AI-assisted discovery in the first half of 2026; 14 were confirmed exploited.
• The money: maintainer-security funding exists, from Germany's Sovereign Tech Agency and a $12.5 million AI-company pool, but it's small next to the reliance the PHP Foundation describes.

What did Sam Altman say about patching bugs?

Altman spoke in Stanford Graduate School of Business's "View From The Top" series, interviewed by MBA student Claudia Chen; the school posted the video on October 21, 2026. Gizmodo's AJ Dellinger reported his cybersecurity remarks on October 23. According to Gizmodo, Altman said:

• "I no longer think we're going to be able to just patch all the bugs."
• On reactions to Anthropic's Claude Mythos: "People definitely patched some bugs, but it was another one of these cases where people didn't really intuit the exponential."
• "Largely speaking, I think most organizational leaders have somewhat moved on. And the models have kept going."
• "I think we're going to have to completely switch the defense model to using the same technology."

Gear Live reported the same core quote the same day, citing Gizmodo. The video's own description says cybersecurity risks "deserve more attention." The quotes here come from Gizmodo's account; the video page carries no transcript.

Altman's company is a direct participant. OpenAI's security researchers were credited on PHP2Shell and on the Brotli decoder flaw known as HTTP2Shell, and OpenAI proposed its Patch the Planet disclosure framework on October 21. Amazon has said it saw a PHP2Shell exploitation attempt on October 17, four days before the fixes shipped. His point, that patching alone won't keep up, is also an argument for selling AI-based defense, which is what OpenAI and its rivals offer.

What did Cloudflare's Matthew Prince say?

Reuters' Raphael Satter and AJ Vicens reported on October 24, 2026, after speaking to seven cybersecurity professionals, that AI-discovered vulnerabilities are almost certain to trigger more disruption. Prince, in an interview on Thursday, October 22, said: "I think we're going to have a couple years where every single week it's going to feel like the sky is falling." He also referred to "a bunch of additional severe vulnerabilities that are present in other pieces of critical software," without naming them.

One correction to how this circulated: some summaries described Prince's quote as "apocalyptic." That word isn't in the Reuters text; it was an aggregator's headline. And the story is a Reuters report, carried by the Star-Advertiser, not an Associated Press one.

Reuters also reported:

• Outages spread across government websites in Europe and elsewhere starting Wednesday, October 21, after the PHP weaknesses were disclosed; some operators took sites offline until they could patch.
• VulnCheck's Patrick Garrity said: "I think there's going to be a lot more fire drills for anything that's internet exposed."
• Not everyone agreed it means more breaches. Curl's lead developer, Daniel Stenberg, argued that AI-found bugs tend to be exotic and hard to exploit, and ArmorCode's Ramy Rahman said "more disclosed vulnerabilities do not automatically mean more successful attacks."

Reuters said the experts agreed that defenders' timelines are shrinking but split on whether AI will produce a hacker free-for-all.

What does the PHP Foundation say about its funding?

The PHP Foundation's executive director, Elizabeth Barron, gave Reuters' Toby Sterling the numbers on October 23, 2026:

Last verified: October 26, 2026

The contractor count differs slightly by source: Barron told Reuters 14 mostly part-time contractors, while Bergmann's September post said 13 contracted engineers maintain the language. Both describe a team in the low teens.

The foundation's own October 21 post is blunter about PHP2Shell. One of the flaws was first noticed by a PHP developer in 2024, and the foundation wrote that "the delay was a structural failure, caused by both the security team's decision process and its lack of resources." It said that without its funding "it would have been impossible to have multiple people work on this issue full time," and asked companies to "please sponsor the PHP Foundation at a level that reflects how much you rely on it." On October 14 it had written that "AI tools have made security reports much cheaper to write over the last year," and that raw model output with a crash that doesn't reproduce takes as long to rule out as a real bug takes to confirm.

Reuters reported that PHP may underpin up to 70% of websites and that Cloudflare reported millions of hacking attempts. Cloudflare's own October 21 post, updated October 23, says it "observed attack traffic" but gives no count.

How many vulnerabilities is AI finding?

The best published count comes from VulnCheck. In its "State of Exploitation H1 2026" report, published July 28, 2026, researcher Patrick Garrity counted 1,061 vulnerabilities "attributed to AI-assisted discovery" in the first half of 2026. Of those, 14, or 1.3%, had been confirmed as exploited in the wild.

The limits matter. VulnCheck built the count from disclosures credited to Anthropic's Project Glasswing and from a dataset from the Berkeley Vulnerability Research Initiative; it doesn't cover every AI-assisted find, and it gives no formal definition of "AI-assisted." The same report says Anthropic reported more than 23,000 findings through Glasswing, of which 126 had become published CVEs and one was confirmed exploited. Garrity's conclusion was cautious: "Early exploitation activity has not scaled at the same pace as CVE issuance."

Reuters reported on October 24 that VulnCheck research due "in the coming days" shows AI helped drive a year-on-year doubling of discovered flaws. VulnCheck's own October 22 blog post, also by Garrity, already says "we've seen 100% YoY CVE growth," which it says appears to be driven by a combination of AI tooling for vulnerability discovery and expanded capacity among CVE numbering authorities, the organizations that assign CVE IDs. The post doesn't explain the data or method behind that figure, and Reuters didn't give the underlying numbers, so this analysis treats the July report as the firmer count. The same post says 51% of submissions to VulnCheck's own vulnerability-reporting service self-report that the flaw was found using AI.

So two things are true at once. Exploitation of AI-found bugs has been rare so far, by VulnCheck's count. And the cost of handling reports, valid or not, lands on small teams like PHP's.

What happened in October 2026?

AI-found bugs and maintainers, October 2026

1. Oct. 8Anthropic launches OSS Scanner, free AI scans for open-source projectsConfirmed
2. Oct. 9Postgres committer says LLM-assisted review surfaces defects faster than they can be fixedConfirmed
3. Oct. 14PHP Foundation: AI 'made security reports much cheaper to write'Confirmed
4. Oct. 14Bank of America says it added 1,000 contractors for Mythos remediationConfirmed
5. Oct. 17Amazon sees first PHP2Shell exploitation attemptReported
6. Oct. 21PHP2Shell fixed; OpenAI proposes Patch the Planet; Node.js fixes Brotli flawConfirmed
7. Oct. 21Altman's Stanford GSB talk postedConfirmed
8. Oct. 22Anthropic reports formal proofs for 123 librariesConfirmed
9. Oct. 23PHP Foundation director tells Reuters PHP is under-fundedReported
10. Oct. 24Reuters quotes Prince: 'the sky is falling' every weekReported

• Confirmed
• Reported

The month started with Anthropic offering free AI scans to open-source projects through OSS Scanner on October 8. On October 9, a PostgreSQL committer tied part of a heavy fix cycle to LLM-assisted review; the release team later pushed Postgres 19 to November 19, as our Postgres story covers. On October 14, Bank of America's CEO said the bank added 1,000 contractors to remediate flaws found with Claude Mythos, per our report.

What are projects changing?

Projects have started rewriting their rules for AI-found bugs:

• PHP says AI-found reports are welcome if the reporter reproduces the issue and understands it. Since May 2026 it has an Ecosystem Security Team, it added an AI security engineer in residence and staff for triage and hardening, and the security team has started changing its process so decisions can be made by majority, according to its October 14 and 21 posts.
• The Linux kernel tells anyone who used AI to find a bug to "treat it as public," as our kernel story explains.
• OpenAI's Patch the Planet proposal lets maintainers decide who gets early warning, with no fixed deadline.
• Anthropic's formal verification work, published October 22, goes the other way: instead of finding bugs, it tries to prove a whole class of crash can't happen in compiled code from 123 open-source libraries, within limits our research story spells out.

Who funds the people who fix the bugs?

Public and corporate money for maintainer security exists, but in amounts that are small next to the dependence the PHP Foundation describes:

• Germany's Sovereign Tech Agency lists a €205,000 investment in the PHP Foundation for 2023 and 2024, covering a rewrite of PECL extension distribution, a codebase security audit, documentation and a PHP-FPM testing tool. Bergmann's post says the agency also commissioned work on PHP's stream layer.
• Alpha-Omega and OpenSSF, Linux Foundation security projects, announced $12.5 million in grants on March 17, 2026, from Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft and OpenAI. The Linux Foundation said maintainers face "an unprecedented influx of security findings, many of which are generated by automated systems." Alpha-Omega said it would bring "maintainer-centric AI security assistance" to projects.

The pattern is worth naming: several of the companies whose models produce the reports also fund the triage. Whether that keeps pace with the report volume is the open question Barron raised.

What's confirmed, reported and uncertain

• Confirmed (primary documents): the PHP Foundation's report counts, structural-failure statement and process changes; its 2025 contribution figures (its own blog); VulnCheck's H1 2026 counts; the Sovereign Tech Agency's €205,000; the Linux Foundation's $12.5 million; VulnCheck's own statement of 100% year-over-year CVE growth (October 22); the Stanford GSB video and its October 21 date.
• Reported: Altman's quotes (Gizmodo; the video page has no transcript); Prince's quotes, the government-site outages and the expert views (Reuters, October 24); Barron's staffing figures and quotes, the 70% estimate and Cloudflare's "millions" of attempts (Reuters, October 23).
• Uncertain: which "additional severe vulnerabilities" Prince meant; the data and method behind VulnCheck's doubling finding, which its October 22 post states without detail and Reuters described as forthcoming research; how many AI-found bugs will be exploited; whether new funding will match the report volume.