Hello. I am Haruaki Matsumoto, Tokyo Branch Manager of Next Generation AI Education Co., Ltd.
In October 2026, a critical security weakness (vulnerability) was discovered in the programming language ‘PHP,’ which powers the backends of websites around the world. This caused a major stir in Japan, leading to an emergency appeal from the Prime Minister and the temporary suspension of government and corporate websites.
When we see news like this, we tend to want to play the blame game, asking, ‘What exactly went wrong?’ or ‘Who was at fault?’ Was it the people who wrote the program, the companies operating the sites, or the people who found the hole?
However, when we calmly examine the events one by one, the conclusion that emerges is ‘it was not that any specific person was at fault, but rather an unavoidable problem that was bound to happen due to the evolution of AI.’
Today, using this PHP security issue as a starting point, I will break down—in a way that is easy for beginners to understand—the boundary between what can and cannot be protected now that AI has entered the picture, as well as the ethical questions we must face.
1. What happened with the PHP vulnerability issue: The reason why we can actually say ‘no one is to blame’
Even doors that have been closed for a long time change how they open due to the evolution of AI. Inspecting the premises of traditional security. (Conceptual diagram, AI-generated)
First, let’s briefly look back at what happened with the PHP issue.
PHP is a programming language that acts as the ‘foundation’ of the internet, used by about 70% of websites worldwide (PHP2Shell Official Special Site). The defect discovered this time (commonly known as PHP2Shell) was not something someone accidentally mistyped recently; it had actually been lying dormant deep within the program for over 10 years (Nomura Research Institute (NRI)).
So, why did no one in the world fix it for over 10 years?
It is not because the developers were slacking off. It is because the conditions required for the problem to occur were so complex that it was considered ‘practically impossible for humans to combine them and exploit them using their heads and manual labor.’ In a world where humans live using ordinary tools, that door was effectively a ‘door that would not open.’
However, the emergence of AI agents has fundamentally overturned that premise.
It has been reported that a single researcher, working with cutting-edge AI, solved in one week a complex puzzle combination that would have taken a top-tier team of humans months to solve (Wiz Research).
In other words, it is not that someone suddenly cut corners, nor was the PHP language particularly inferior. ‘With the arrival of AI, things that were previously protected thanks to human limitations can no longer be protected as they are’ is the true nature of this incident.
2. The warning bell rung by Anthropic has become reality
Advanced AI capabilities are spreading. How can the defending side secure time to prepare? (Conceptual diagram, AI-generated)
In fact, there were people who had been strongly warning that such a situation would occur for more than half a year. It was Anthropic, the American company that developed the conversational AI ‘Claude.’
In April 2026, Anthropic developed a new AI model, ‘Claude Mythos,’ capable of autonomously finding weaknesses in programs. However, because its capabilities were too high, they decided that ‘if released to the public as is, it could be used directly for malicious cyberattacks,’ so they postponed the public release and limited it to a system that only defense experts could use (Anthropic Official Announcement).
At that time, Anthropic issued a warning to the following effect.
Even if advanced AI is provided only to a limited number of people, there is a risk that similar capabilities will eventually fall into the hands of those who do not intend to operate it safely.
And in the autumn of 2026, research results confirming those concerns were published. A research report released by Anthropic at the end of September also stated that the publicly available ‘GLM-5.3’ showed performance close to the ‘Claude Mythos Preview’—which was provided on a limited basis in the spring—in experiments to create attack programs (Anthropic Research). Meanwhile, this PHP2Shell is another case discovered and demonstrated by defensive researchers using Gemini and GPT-based AI.
3. ‘Distillation’ and ‘Open-Weights’: It is not that Chinese models themselves are bad
Separating the value of technology from the risk of misuse, and keeping an eye on how it is used after release. (Conceptual diagram, AI-generated)
Why does the capability created by cutting-edge AI companies at enormous cost spread throughout the world in just a few months? To understand the background, let me introduce just two terms.
① Distillation
Distillation is a method of training another model using the output of a teacher model as a guide. (Conceptual diagram, AI-generated)
The first is ‘distillation.’ Originally a term from alcohol production or chemistry, in the world of AI, it refers to ‘a technique for efficiently making a new AI (student) smarter by asking a pre-existing, highly capable AI (teacher) many questions and using its answers and reasoning paths as a model’ (Ledge.ai).
Rather than studying by trial and error from scratch, looking at the notes of a teacher who can already get a perfect score allows you to create a model that is just as capable, overwhelmingly faster and at a lower cost.
② Open-Weight
Being able to hold the weights in your own hands creates both the freedom for research and application, and the possibility of changing safety measures. (Conceptual diagram, AI-generated)
The second is ‘open-weights’. The cutting-edge models from OpenAI and Anthropic are kept deep within company servers, and we cannot modify their contents at will (closed models). In contrast, ‘open-weights’ refers to models where the data of the AI’s brain itself (the weights) is published on the internet, allowing anyone to download it to their own computer or server and run it freely.
There have been successive reports and investigations suggesting that Chinese AI companies and others are efficiently extracting capabilities from cutting-edge models like OpenAI’s ‘Codex’ or Anthropic’s ‘Claude’ through ‘distillation,’ creating extremely capable models, and releasing them to the world as ‘open-weights’ (Ledge.ai).
Here, there is an important point we want to calmly distinguish.
That is, ‘it is not that Chinese AI models themselves are bad, nor is the mechanism of open-weights publication itself bad’.
Making good technology open so that researchers around the world can use it has great value for the development of science and industry. The real problem is that because models released as open-weights can be freely modified at hand, malicious individuals can easily remove the ‘safety guards’ (guardrails) installed by the developers (Anthropic Research).
High-performance AI with safety devices removed can now be run by people with malicious intent. Anthropic warns that the proliferation of such capabilities makes it easier for attackers to abuse sophisticated methods. What we must address is not a specific country or the technology itself, but the ‘structure where malicious people can abuse open technology.’
4. Tracing it back to the ethical perspective that ‘humans have created AI that is too capable’
The same intelligence can be both a shield and a spear. Thinking about the responsibility of living with the technology we have created. (Conceptual diagram, AI-generated)
From here on, based on the facts so far, I will think about this from my own ethical perspective.
Looking at this PHP issue and the successive cyberattacks,
-
“The developer who left old programs behind is to blame.”
-
“The company that distilled it without permission and spread it with open weights is to blame.”
-
“The field teams that couldn’t keep up with countermeasures are to blame.”
It is easy to make someone the villain like this.
However, what if we trace it back to the very root?
In the first place, it was none other than us humans who first created AI that is far superior to human ability, such as ‘Claude’ and ‘Codex’.
As a result of humans pushing the limits of intelligence in the hope of ‘making things more convenient’ and ‘solving more complex problems,’ we created the key to Pandora’s box that no one had been able to open for ten years. At the same time, problems have arisen where similar keys are becoming widely accessible through ‘distillation’ and ‘open weights’.
When we trace the common roots like that, we realize that the problem surrounding safety in the AI era is “a structural problem born not from the malice or negligence of any one person, but from the fact that humans created intelligence that is too superior.”
In the worlds of ethics and the history of science, the nature of the same technology being both a ‘shield to help people’ and a ‘spear to hurt people’ is called “dual-use.” We cannot turn back the clock and make the level of intelligence that humans have once created ‘never have existed.’ That is precisely why we need to move from the stage of blaming ‘who is at fault’ to the stage of thinking about ‘how to come to terms with a world where this intelligence naturally exists.’
5. Beyond ‘Who is at fault’: Three perspectives we should prepare for from now on
Inventory, separation of important functions, defense, and stop judgment. Concrete realization of mechanisms that support safety. (Conceptual diagram, AI-generated)
Because we live in an era where no one can be made the villain, I will organize three perspectives that we who will be involved with AI and the internet from now on should have.
1. Take an inventory of ‘what we have been able to protect until now’
Understand the systems we depend on and their connections. (Conceptual diagram, AI-generated)
The premise that ‘it was fine for 10 years, so it will be fine from now on’ no longer holds true with the advent of AI. What kind of systems and tools are you using as a foundation in your company or personal work? First of all, grasping (taking an inventory of) ‘what you are standing on’ on a daily basis is the first step to moving quickly when the time comes (Nomura Research Institute (NRI)).
2. Separate the ‘important heart’ from the ‘public window’
Design so that even if a problem occurs at the public window, the damage does not reach important functions or data. (Conceptual diagram, AI-generated)
This time, many banks in Japan temporarily stopped their ‘windows using PHP,’ such as websites and reservation screens, but because the ‘heart of payment’ that moves money was separated by a different mechanism, the functions of the banks themselves did not have to stop (Nomura Research Institute (NRI)). In an era where it is difficult to prevent all attacks 100%, a design that separates things so that ‘even if a hole is found in the window, the most important heart and personal information are in a different place and protected’ is the ultimate lifeline.
3. The defending side should use AI and have the judgment to ‘stop once when it is dangerous’
While using AI for defense, humans judge the timing to stop and the targets to protect. (Conceptual diagram, AI-generated)
If malicious actors use open-weight AI, the defenders have no choice but to use even better AI to find and patch holes before they are exploited (PHP2Shell Official Special Site). And when fixes cannot be made in time, humans must be prepared to make the decision to ‘shut down services before damage occurs,’ as many companies chose to do during this recent incident. No matter how fast AI becomes, the responsibility of deciding ‘what to protect and when to stop’ remains with humans until the end.
Summary
Safety in the AI era begins with re-examining what we protect and how we protect it, one by one. (Conceptual diagram, AI-generated)
Looking back at this PHP security issue, there was no specific ‘villain’ involved.
-
Programs from over a decade ago suddenly becoming ‘open doors’ due to the evolution of AI
-
Separately, as research from Anthropic shows, the fact that advanced attack capabilities have become accessible even with open weights
-
And above all, the fact that humans themselves created such overwhelming AI
This incident also highlights the structural challenges of the AI era.
When new technology shakes society, we tend to look for ‘who is to blame’ to feel at ease. However, what is truly needed is not a witch hunt, but rather ‘calmly reassessing what can now be protected by AI and what can no longer be protected by conventional methods.’ Isn’t that the case?
In your workplace or daily life, are there things you assume are safe just because that’s how they’ve always been done?
Why not take this opportunity to inspect the foundations you are standing on?
References and Sources
Tracing sources to connect confirmed facts with the ethical questions they raise. (Conceptual diagram, AI-generated)
If you would like to experience AIO countermeasures applicable in the AI era, or if you are struggling with the design of AI education and corporate training, please contact us.
Next Generation AI Education Co., Ltd. Tokyo Branch Manager, Shunju Matsumoto
#AI #AIera #AGI #AIAgent #GenerativeAI #PHP #Cybersecurity #Anthropic #Claude #OpenWeights #AIEthics #HaruakiMatsumoto #NextGenAIEducationInc #HealthyAI
