‘Babe, wake up, the internet is collapsing’: Two massive flaws just broke the web, and the data of billions is in the crossfire

If you opened X this morning, you might have seen this viral tweet floating around cybersecurity circles. It’s hilarious, but it’s also uncomfortably close to the truth.

babe wake up the internet is collapsingOctober 22, 2026

Over the past 24 hours, two completely separate, absolutely massive cybersecurity disasters collided.

First, Microsoft revealed that a nation-state hacking group used an autonomous AI agent to brute-force its way into thousands of cloud accounts in a matter of hours.
Then, a critical vulnerability was discovered in PHP — the foundational code that runs roughly 70% of the entire internet — forcing major sites like Wikipedia to temporarily pull the plug on their own servers just to survive.

If you are wondering why IT departments across the globe are currently stress-sweating through their flannels, here is a breakdown of exactly what is happening, and what you actually need to do about it.

Disaster 1: The autonomous AI hacker (ARTEX)

microsoft — (Image credit: Shutterstock)

I’ve spent the past couple of weeks writing about how to build a local AI agent — like my digital assistant “Jeeves” — to automate admin tasks like checking your Gmail.

Well, a Chinese-linked threat actor known as “Storm-0940” just showed us the dark mirror version of that exact technology.

According to Microsoft, the hackers stole credentials to ConnectWise (a massive IT management software provider). But instead of typing in passwords, they handed those credentials to an agentic AI tool called ARTEX.

ARTEX is essentially a malicious version of Jeeves. The hackers gave the AI a goal, pointed it at Microsoft 365, and let it off the leash. The AI divided up the tasks, bypassed standard logins by hijacking authentication apps, and achieved a terrifying 2,900 sign-in attempts per minute.

Within a few hours, the AI had hit 2,250 different corporate tenants across aerospace, defense and finance. It moved so fast that human security defenders literally didn’t have time to read the alerts before the AI had already gained privileged cloud access.

It is the ultimate proof that the “cloud tax” isn’t just expensive — it’s a massive, centralized target for autonomous bots.

Disaster 2: The PHP meltdown

And while that AI was busy tearing through Microsoft 365, the actual foundational bricks of the internet started crumbling. On October 21, the PHP project disclosed two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

To spare you the hyper-dense developer jargon: there is a flaw in how PHP handles memory. If an attacker sends a specific, unauthenticated request to a web server, they can corrupt the memory and execute their own malicious code directly on the machine.

It’s been so bad, it scored a 9.2 out of 10 on the severity scale.

Why is this a big deal? Well, PHP is the backbone of WordPress, major content management systems, and millions of custom web applications. It powers roughly 70% of the entire web.

The vulnerability is so trivial to exploit — and the blast radius is so large — that both Wikipedia, the Internet Archive and Steam reportedly took precautionary measures to shut down their infrastructure while applying the patch.

An update from Brewster Kahle on today's outage. https://t.co/Gukju5sKFOOctober 21, 2026

Ironically, Wiz Research actually used Google’s Gemini 4 Argon AI model (alongside OpenAI’s GPT-5.6 Sol) to help find and validate the patch for this PHP flaw. So, while one AI is currently attacking the cloud, another AI is desperately trying to patch it.

What you need to do

If you are just a regular person trying to browse the web and get your work done, you don’t need to throw your laptop in a lake. But you do need to be on the defensive.

If you are a consumer

This is the exact moment when credentials stolen in massive cloud breaches end up on the dark web. Assume your passwords have been swept up in the chaos. If you aren’t using a password manager or hardware-based multi-factor authentication (MFA), you are a sitting duck for an AI like ARTEX. Take some time to protect yourself.

If you are a business owner

Call your web hosting provider or IT contractor immediately. Ask them two questions: “Have we applied the October 21 PHP security patches?” and “Are our Microsoft 365 OAuth applications audited?” If you get a blank stare or an awkward silence, you have a problem.

The internet may not be literally collapsing, but the walls are definitely shaking. When autonomous AI agents can breach thousands of cloud tenants before a human can even click on an alert, relying entirely on massive, centralized tech conglomerates to keep your data safe is a losing bet.