The day AI almost broke internet — Or did it save us?

• A worldwide security scare offers a lesson every business leader should consider

By Stefan F.M. Dittrich 

Across Europe and the United States, business owners and IT teams faced an alarming sight: websites and online services were suddenly unavailable. Customers could not reach familiar pages. Companies worried about lost orders, disrupted operations and reputational damage. In Sri Lanka, the timing may have been fortunate: the worst disruption came after most offices had closed, unlike the working day still under way in Europe and America. But the warning was universal. How quickly could your business cope if its digital front door suddenly disappeared?

The obvious question was also the most frightening: Had artificial intelligence finally turned against us? Was this the first major technological disaster caused by machines becoming too powerful? The truth was far more surprising. AI had not brought down the internet. It had helped uncover a threat serious enough that organisations were taking websites offline as a precaution.

At the centre of the crisis were two dangerous weaknesses in PHP, a programming language operating behind the scenes of a huge share of the world’s websites. Think of it as part of the hidden engine beneath online shops, booking systems and company portals. The weaknesses could allow criminals to break into vulnerable servers, steal information or interfere with vital services. Security teams rushed to install fixes, while some organisations temporarily suspended access rather than leave their systems exposed.

Here is the remarkable part: the underlying flaws had been hidden in software for roughly two decades. Human experts had studied and improved this technology for years. Yet it took AI-assisted security research to help reveal the danger. Researchers at Calif used OpenAI’s GPT-5.6 Sol to uncover a critical flaw; the cybersecurity company Wiz independently identified both vulnerabilities. The researchers, programmers and hosting providers who coordinated the response were human. AI was a powerful instrument in their hands.

How close did we come to a genuine digital catastrophe? Nobody can say for certain, and the full economic cost of the disruption has yet to be calculated. But the scale of the danger was extraordinary. PHP powers approximately 70 percent of the world’s websites, and the newly discovered vulnerabilities received a critical severity rating of 9.2 out of 10. Security researchers had demonstrated that attackers could potentially gain control of vulnerable servers without even knowing a password. Fortunately, an international effort involving human experts and AI-assisted research had already begun preparing protections weeks before the public announcement. This gave defenders a crucial head start. The incident was not a global internet collapse, but it was a powerful reminder of how much damage could result if such weaknesses were exploited before anyone had the chance to stop them.

This incident also exposed an uncomfortable truth: our dependence on the internet has reached a point where even a temporary disruption can have serious consequences. We are no longer talking merely about interrupted entertainment, social media or online shopping. Hospitals depend on digital systems, businesses rely on online transactions, supply chains are coordinated through connected platforms, and financial institutions process millions of operations every day. For many companies, losing access to essential digital services is no longer simply an inconvenience. It can threaten their very existence. And the more interconnected our systems become, the greater the risk that a single technical failure could trigger a chain reaction far beyond its original source.

For business leaders, this should be a wake-up call. Digital transformation must never mean digital dependence without a backup plan. Every organisation should ask itself some uncomfortable questions: What happens if our website, payment systems or communication channels suddenly stop working? Can we continue operating without internet access for several hours, or even days? Do we have reliable backups, alternative communication channels and clearly defined emergency procedures? And, perhaps most importantly, have we actually tested them? Preparing for such scenarios is not merely an IT department’s responsibility. It is a fundamental part of modern leadership, risk management and business continuity. The companies that survive tomorrow’s digital crises will not necessarily be those with the most advanced technology, but those that have prepared for the possibility of that technology failing.

Yet the lesson extends far beyond corporate boardrooms. As individuals, societies and nations, we are increasingly placing essential aspects of our lives into the hands of complex technological systems that few of us fully understand or control. From healthcare and education to transportation, communication and national infrastructure, our collective dependence continues to grow. Artificial intelligence and robotics will accelerate this transformation even further. This progress offers extraordinary opportunities, but it also raises a fundamental question: Are we building technology that makes humanity stronger and more independent, or are we gradually creating a civilisation that can no longer function without it? The answer will depend not only on innovation, but on our willingness to preserve human skills, maintain alternatives and ensure that technology remains our servant rather than our master.

But there is another, perhaps even more alarming lesson we cannot afford to ignore. Cyberattacks are no longer simply the work of individual hackers sitting behind computer screens. They are increasingly automated, with artificial intelligence helping criminals identify weaknesses, develop attacks and operate at a speed and scale previously unimaginable. In the near future, we may find ourselves defending our businesses against AI systems capable of discovering vulnerabilities faster than human experts can respond. The very technology that helped protect us this time could become an equally powerful weapon in the wrong hands. We must not mistake a fortunate outcome for a guarantee of future safety. 21 October should be our wake-up call, a warning shot across the bow. We have been given an opportunity to prepare before a far more devastating incident occurs. Ignoring that warning because everything turned out well this time would be dangerously irresponsible.

Fire can warm a family or destroy a home. Water can save a life or take one. A knife can prepare dinner or cause harm. AI, too, is defined not merely by its power but by the intentions, safeguards and responsibility of those who use it. That demands critical scrutiny, clear ethical standards and human accountability — not blind enthusiasm, but not reflexive fear either.

The lesson of October 21 is not that AI will always save us. It is a reminder that digital dependence creates real business risk — and that the same emerging technologies which introduce new risks can help us manage them. AI can strengthen cybersecurity, improve decision-making and unlock opportunities for smaller companies. But in the wrong hands, it can also make fraud, manipulation and cyberattacks more sophisticated.

(The author is the CEO of Lanka Code Labs and DittRich FZ-LLC in the UAE)