Let's look back over the past five weeks.

On the night of 11–12 October, attackers accessed the refrigeration controls of hundreds of French supermarkets over the internet. They changed the temperatures and caused food losses worth millions of euros.

On 2 November, something similar happened in supermarkets in other European countries. In Estonia, a freezer was found set to 50 degrees.

On 10 November, France attributed the October attacks to a cyber unit linked to Iran's Revolutionary Guard. Responsibility for the later attacks is less clear.

But something even more interesting happened between those two episodes.

On 21 October, governments and companies in different countries began taking websites offline as a precaution.

Two critical vulnerabilities had been discovered in PHP, a technology used by 68.3% of websites whose server-side programming language W3Techs can identify. The flaws, known as PHP2Shell, could allow code to be run on vulnerable servers without knowing any password.

Public bodies and companies in Germany, France, the Netherlands and the United Kingdom temporarily suspended services. The reason was simple: they could not guarantee their security while preparing fixes.

What was extraordinary was that artificial intelligence had played a direct part in discovering and experimentally exploiting vulnerabilities that had been in the software for years. Calif, working with Ryan Austin, and Wiz investigated them independently.

On 5 November, OpenAI introduced GPT-6 Cyber. Its researchers had used the model to find 81 previously unknown high-severity vulnerabilities in Firefox and develop 948 working local privilege escalation exploits in Linux. GPT-5.6 Sol had found and exploited 166 vulnerabilities in an earlier scan using the same research system, on a different development version of the kernel.

More than five times as many.

On 12 November, Microsoft 365 went down. Outlook, Teams and other services stopped working properly in numerous countries, some for more than a day.

The following day, the United States halted all takeoffs nationwide for about five hours because of problems with air traffic control communications systems.

The official explanations for these latest outages point to technical failures, with no known evidence of cyberattacks.

It may be a coincidence.

But I think we are seeing something more important than a series of incidents.

The protection we never knew we had

For decades, finding serious vulnerabilities in a complex program required specialists, a great deal of time and resources.

That had a consequence we may never have fully appreciated: millions of bugs remained hidden, not because the systems were secure, but because finding them was too difficult.

Complexity acted as accidental protection.

Artificial intelligence is tearing down that barrier.

The flaws discovered in Firefox or PHP did not appear this autumn. They were already there.

What has changed is our ability to find them and demonstrate how to exploit them.

And this radically changes the balance between attackers and defenders.

The attacker needs to discover one exploitable vulnerability. The defender must find it, fix it, check that the fix works and make sure it does not break the rest of the system.

PHP2Shell illustrates the problem perfectly.

The PHP Foundation acknowledged that the first signs of one of the problems had appeared in 2024. Fixing it was complicated. There were issues with compatibility, resources and organisation. It had remained unresolved since 2024.

Knowing that something might be wrong was not enough. A solution had to be found that would not break other things. That was the difficulty. And it did not disappear when artificial intelligence arrived.

What AI did was demonstrate how serious the problem was. Researchers assisted by these tools managed to show how to exploit it. An international race to install patches began. Some public bodies and companies preferred to take services offline rather than risk an attack.

AI helped cause service interruptions without having to attack those services. Discovering that they could be attacked was enough.

The race against time

This is where my speculation begins.

We have ageing infrastructure. Systems that cannot be replaced overnight. And now we have tools capable of finding vulnerabilities in days.

The response seems obvious: rush. Install patches. Reconfigure. Replace whatever is no longer considered secure. Do as quickly as possible what, until yesterday, could wait.

But infrastructure cannot be modernised at the speed at which AI discovers vulnerabilities. Every update carries risks. Every change requires checks that the system still works. And haste makes none of those needs disappear.

At Microsoft, the failure surfaced after a recent change to an earlier expansion of its network infrastructure.

According to CBS, a communications update included security patches. Older equipment became overloaded, according to the Department of Transportation's official explanation.

We do not know whether those changes were a response to the vulnerabilities described here or whether a threat caused them to be rushed. The technical investigation into the aviation outage was still open.

My hypothesis is precisely that race. Old systems that need changes. Tools that discover reasons to change them ever faster. And people forced to decide how much time they can afford to make those changes without breaking them.

In that scenario, an attacker is not even necessary. Fear of an attack is enough to force rapid changes to systems that need to be changed slowly.

To test this, we would need to know the reasons for the Microsoft and FAA updates, and whether an urgent need for defence lay behind them. Then we would need to watch whether emergency patches become more frequent and the time between the discovery of a vulnerability and its exploitation gets shorter. And check whether outages during updates also increase.

The worrying thing is that I may be wrong

Suppose it is proved tomorrow that Microsoft and the FAA suffered two completely independent accidents. No attack. No urgent update prompted by fear of vulnerabilities.

No connection.

Entirely possible.

But we would still have three facts.

First: someone managed to cause physical damage in hundreds of European supermarkets through their IT systems.

Second: the AI-assisted discovery of old vulnerabilities forced governments and companies to take web services offline as a precaution.

Third: two technical failures, barely a day apart, disrupted international IT services and takeoffs across the whole of the United States.

And all this has happened as systems emerge that can dramatically accelerate the discovery and exploitation of vulnerabilities.

That combination should worry us even if the incidents are unrelated.

For decades, we have built a society dependent on complex, interconnected technological infrastructure that is difficult to modernise.

Some of its vulnerabilities remained hidden because finding them was complicated.

That difficulty is diminishing.

And our ability to fix them is not necessarily growing at the same speed.

I do not think someone coordinated all these events.

I worry that no one needs to coordinate them.

That we are entering an era in which weaknesses accumulated over decades can be discovered faster than we know how to repair them.

And that, when we rush to close those doors, we will break other things along the way.

Too much in too little time.

Perhaps it is a coincidence.

But what is changing is not our ability to build vulnerable systems. We have been doing that for decades.

What is changing is our ability to find them.

And I suspect we are only just beginning to understand the consequences.

Main sources

Opinion article. The hypothesis of a common structural cause and possible rushed defensive updates is the author's speculation. No causal relationship between the incidents described has been demonstrated.

Text by Roberto Ortega, prepared with AI editorial assistance. The Norwegian and English editions are editorial adaptations of the Spanish original.