A surge in AI-enabled cyberattacks is testing the security of the digital systems that now underpin banking, shopping, cloud storage, websites and connected homes. The incidents described in a Hindustan Times report point to a wider urban infrastructure problem: everyday services may be digitally accessible, but the systems securing them remain unevenly protected and difficult to monitor at internet scale.
The immediate concern is not one isolated breach. The report brings together warnings involving State Bank of India customer records, Microsoft’s assessment of a Chinese group using AI-enabled penetration techniques, attacks on financial institutions in South Korea, and efforts by US banks to prevent AI agents from operating inside customer accounts. It also describes a vulnerability affecting PHP, an open-source programming language used by millions of websites.
Taken together, these events show how cyber risk has moved beyond the information-technology departments of large organisations. A vulnerable web server can become a route into customer data, authentication tokens, cloud backups or connected devices. For residents, the consequence may not be a visibly disrupted city street or a failed physical utility, but the loss of access, privacy or trust in the digital services through which urban life is increasingly organised.
The PHP vulnerability, referred to in the report as PHP2Shell and associated with CVE-2026-109618 and CVE-2026-109619, illustrates the speed of the new threat environment. The vulnerability was disclosed on social media before a patch was readily available to every developer and IT department. The report says many websites were taken offline as a precaution while organisations assessed their exposure.
Cloudflare Chief Executive Matthew Prince said the company observed thousands of attempted exploits in the 10 hours before public disclosure. According to the statement cited by Hindustan Times, the activity rose to tens of thousands in the 45 minutes after disclosure, hundreds of thousands within two hours and millions thereafter. These figures describe activity observed across Cloudflare’s network; they do not establish how many systems were successfully compromised. They do, however, show the operational difficulty of defending a widely used technology once details of a vulnerability become public.
The institutional problem is the gap between discovery, disclosure and patching. A vulnerability may be identified by researchers, but fixing it requires action by software maintainers, hosting companies, website operators, enterprise security teams and, in some cases, consumers using products built on the affected technology. Each layer has different visibility, resources and incentives. A patch released by a software maintainer does not mean that every server, website or device has installed it.
That gap is particularly important for urban digital infrastructure because the internet is not a single centrally managed system. It is a patchwork of private websites, banks, cloud services, public platforms, enterprise networks, household devices and third-party vendors. The user may experience them as one seamless digital environment, but responsibility for security is dispersed among many organisations.
The report also describes how AI is changing both sides of this contest. OpenAI is cited as having worked with maintainers, researchers and security providers to address critical PHP vulnerabilities under the Patch the Planet initiative. Wiz Research said its autonomous AI agent, together with models identified as Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, was used in vulnerability research. The stated advantage is speed: AI can help researchers examine complex code and adapt an exploit to different versions, configurations and memory layouts.
That same capability can benefit attackers. The more quickly an exploit can be adapted across different deployments, the lower the technical barrier to targeting organisations that would previously have been difficult to reach. The report quotes Wiz as saying that AI can help scale attacks across different PHP versions, configurations and memory layouts. This creates a security race in which defenders may discover flaws faster, but attackers may also industrialise the process of exploiting them.
The reported timeline involving Amazon Threat Intelligence adds another layer of uncertainty. Amazon said it identified an attempted exploitation of PHP2Shell on October 17, four days before the public disclosure of the vulnerabilities. The attempt came from an internet address associated with a commercial anonymisation network. CJ Moses, chief information security officer of Amazon Integrated Security, said the activity suggested a threat actor may have obtained information before disclosure, while also stating that it remained unclear how that information was acquired.
This distinction matters. The existence of an attempted exploit does not by itself prove that a specific organisation was breached or that the vulnerability was used in a successful attack. It does show why disclosure systems depend on careful coordination. If attackers obtain details before a patch is broadly available, defenders face a narrow window in which systems may be exposed but cannot yet be fully protected.
The risk extends beyond companies operating websites. Kaspersky said the vulnerability could allow an attacker to steal authentication tokens from server memory. Such tokens function as electronic passes that tell a website a user has already signed in. If stolen, they may allow access without the password or two-factor authentication code, potentially exposing messages, documents, delivery addresses, order histories and other confidential information.
Consumer network-attached storage devices are one example of how enterprise-style risks enter homes. These systems are used to store photos, music, backups and other data. The report says manufacturers including Synology confirmed that the vulnerabilities affected products such as Mail Station and Synology Calendar and released fixes for affected products. The broader patch position for smart televisions, appliances, gaming services and other connected devices remains unclear in the supplied report.
This uncertainty is a recurring feature of connected-home security. A household may have a broadband router, cloud storage device, smart television, security camera and multiple mobile accounts, each managed by a different manufacturer or service provider. A consumer may not know which products are exposed, whether a patch is available or whether a device will continue receiving updates. The physical home becomes dependent on a software maintenance chain that is largely invisible to its occupants.
For banks and financial platforms, the stakes are higher because digital identity and payment systems are directly connected to money. The report says the State Bank of India warned that nearly 4,000 customer records had been leaked to the dark web. It also says US banks including JPMorgan, Bank of America and Wells Fargo were responding to concerns that AI agents were operating inside customer banking accounts and could attempt unauthorised money movement. These claims are attributed to the report and the institutions it cites; the material supplied does not establish the full scale or outcome of the incidents.
The consumer response described in the report is familiar but increasingly important: keeping software and device firmware updated, using different passwords across services, avoiding unfamiliar websites and enabling two-factor authentication. These steps reduce exposure, but they do not resolve the underlying structural issue. Individual users cannot patch a vulnerable server they do not control, determine whether a cloud service has been compromised or know whether a connected product will receive a security update.
The policy challenge is therefore larger than urging better digital hygiene. Security depends on how software vendors disclose vulnerabilities, how quickly patches are distributed, how long devices remain supported and how clearly organisations communicate with affected users. It also depends on whether banks, cloud providers, website operators and device manufacturers can identify responsibility across complex supply chains.
The report’s central evidence points to an inflection point rather than a single confirmed collapse of internet security. AI is accelerating vulnerability discovery, but it is also lowering the barriers to exploit development and deployment. Meanwhile, the systems that citizens rely on are distributed across thousands of private and institutional actors, many of whom may have limited capacity to respond quickly.
What is established is that attack attempts rose rapidly after the PHP vulnerability became public, that named technology and cybersecurity organisations reported AI-assisted research and attacks, and that connected consumer products may also be exposed when the underlying software is vulnerable. What remains unclear is the number of successful compromises, the extent of the reported bank-related incidents and the overall patching rate across affected systems. Those unresolved questions will determine whether the current episode is remembered mainly as a fast-moving security scare or as evidence of a deeper weakness in the digital infrastructure of cities.
