If you opened X this morning, you might have seen this viral tweet floating around cybersecurity circles. It’s hilarious, but it’s also uncomfortably close to the truth.

Over the past 24 hours, two completely separate, absolutely massive cybersecurity disasters collided.

• First, Microsoft revealed that a nation-state hacking group used an autonomous AI agent to brute-force its way into thousands of cloud accounts in a matter of hours.
• Then, a critical vulnerability was discovered in PHP — the foundational code that runs roughly 70% of the entire internet — forcing major sites like Wikipedia to temporarily pull the plug on their own servers just to survive.

If you are wondering why IT departments across the globe are currently stress-sweating through their flannels, here is a breakdown of exactly what is happening, and what you actually need to do about it.

Disaster 1: The autonomous AI hacker (ARTEX)

I’ve spent the past couple of weeks writing about how to build a local AI agent — like my digital assistant “Jeeves” — to automate admin tasks like checking your Gmail.

Well, a Chinese-linked threat actor known as “Storm-0940” just showed us the dark mirror version of that exact technology.

According to Microsoft, the hackers stole credentials to ConnectWise (a massive IT management software provider). But instead of typing in passwords, they handed those credentials to an agentic AI tool called ARTEX.

ARTEX is essentially a malicious version of Jeeves. The hackers gave the AI a goal, pointed it at Microsoft 365, and let it off the leash. The AI divided up the tasks, bypassed standard logins by hijacking authentication apps, and achieved a terrifying 2,900 sign-in attempts per minute.

Within a few hours, the AI had hit 2,250 different corporate tenants across aerospace, defense and finance. It moved so fast that human security defenders literally didn’t have time to read the alerts before the AI had already gained privileged cloud access.

It is the ultimate proof that the “cloud tax” isn’t just expensive — it’s a massive, centralized target for autonomous bots.

Disaster 2: The PHP meltdown

And while that AI was busy tearing through Microsoft 365, the actual foundational bricks of the internet started crumbling. On October 21, the PHP project disclosed two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

To spare you the hyper-dense developer jargon: there is a flaw in how PHP handles memory. If an attacker sends a specific, unauthenticated request to a web server, they can corrupt the memory and execute their own malicious code directly on the machine.

It’s been so bad, it scored a 9.2 out of 10 on the severity scale.

Why is this a big deal? Well, PHP is the backbone of WordPress, major content management systems, and millions of custom web applications. It powers roughly 70% of the entire web.

The vulnerability is so trivial to exploit — and the blast radius is so large — that both Wikipedia, the Internet Archive and Steam reportedly took precautionary measures to shut down their infrastructure while applying the patch.

Ironically, Wiz Research actually used Google’s Gemini 4 Argon AI model (alongside OpenAI’s GPT-5.6 Sol) to help find and validate the patch for this PHP flaw. So, while one AI is currently attacking the cloud, another AI is desperately trying to patch it.

What you need to do

If you are just a regular person trying to browse the web and get your work done, you don’t need to throw your laptop in a lake. But you do need to be on the defensive.

The internet may not be literally collapsing, but the walls are definitely shaking. When autonomous AI agents can breach thousands of cloud tenants before a human can even click on an alert, relying entirely on massive, centralized tech conglomerates to keep your data safe is a losing bet.

Follow Tom's Guide on Google News and add us as a preferred source to get our up-to-date news, analysis, and reviews in your feeds.

More from Tom's Guide