Hackers Hit 2,250 Cloud Tenants as Staffing Stays at One
LONDON, October 24, 2026 - The world's technology industry has suffered an embarrassing setback after discovering that the digital infrastructure holding up modern civilisation has serious security weaknesses, that hackers now have artificial intelligence, and that the people responsible for preventing a worldwide technological collapse are working on the staffing budget of a village charity shop.
According to an October 22 report by Tom's Guide, two separate cybersecurity crises have shaken the internet. One involves AI-assisted attacks against corporate cloud accounts. The other involves critical vulnerabilities in PHP, a programming language that, by W3Techs' tracking, sits underneath roughly 70% of websites.
The discovery has forced technology executives to confront a question they have avoided for thirty years: what happens when computers stop doing what the PowerPoint promised?
AI Hackers Hit 2,250 Microsoft 365 Tenants at 2,900 Logins a Minute
According to Microsoft's security investigation, a China-aligned hacking group called Storm-0940 used the ARTEX agentic AI framework to speed up attacks on corporate cloud environments.
At one point the operation was generating approximately 2,900 failed login attempts per minute. Through compromised application credentials, the attackers also reached more than 2,250 Microsoft 365 customer tenants, with some successful intrusions.
For comparison, the average British bank customer gets three password attempts before being locked out, receiving six text messages and being told to visit a branch that closed in 2019.
A London cybersecurity consultant said the attackers had automation to thank.
"Previously, hackers needed determination, technical expertise and an unhealthy relationship with caffeine. Now they can delegate the work to a machine. It's the first profession in history where getting lazier makes you more dangerous."
Corporate security departments were particularly alarmed to learn that machines work weekends.
"This is a completely unfair competitive advantage," complained one exhausted IT manager. "Their hackers don't need annual leave, pensions or mandatory diversity training. We've got Jeremy from Compliance, and Jeremy leaves at four on Fridays."
Microsoft's investigation indicates that many of the attempted logins failed. Even so, compromised trusted applications gave the attackers access to some customer environments.
This introduces a new cybersecurity principle: if hackers can't get through the front door, they may borrow the ID badge of someone who's already allowed in. The UK's National Cyber Security Centre and America's CISA have both spent years urging organisations to turn on multi-factor authentication, advice that is considerably easier to give than to follow on a Friday afternoon.
PHP Foundation Has One Full-Time Employee While PHP Runs 70% of Websites
The second emergency involves PHP, the language used extensively across the internet, including on websites powered by WordPress.
Two critical vulnerabilities potentially allowed attackers to compromise unpatched servers.
The news caused panic among technology companies, government departments and people who had previously assumed PHP was something doctors checked during blood tests.
Then came the real shock.
According to an October 23 Reuters report on PHP Foundation funding, the organisation behind the language, The PHP Foundation, has just one full-time employee, executive director Elizabeth Barron, supported by fourteen mostly part-time contractors.
One.
The global internet economy is worth trillions. PHP helps power a vast share of it. And the organisation supporting the language has fewer full-time staff than a moderately successful hot-dog stand.
Technology executives expressed astonishment.
"One employee? That's irresponsible," declared a corporate vice president whose company employs 4,000 people to produce presentations explaining why its next subscription increase is necessary.
Industry analysts estimate that the average multinational technology company now employs more people to discuss cybersecurity awareness than some critical open-source projects have to maintain cybersecurity.
The world's technological infrastructure increasingly resembles an enormous luxury cruise ship run by one engineer, fourteen volunteers and 6,000 executives attending a leadership conference.
Governments Take Websites Offline to Patch PHP Vulnerabilities
The PHP vulnerabilities prompted organisations around the world to take precautions, including temporarily shutting down affected services while security patches were installed.
Government websites were among the systems disrupted.
This gave British authorities a rare chance to show that public services can stop working because of an external technical problem rather than their usual administrative procedures.
A senior civil servant praised the emergency response.
"We acted decisively by making public services inaccessible before criminals could make them inaccessible. That is precisely the sort of preventative leadership taxpayers expect."
Another official reportedly suggested that disconnecting every government computer permanently would remove the risk of online hacking altogether.
Treasury officials immediately requested a feasibility study after learning the proposal would also eliminate several thousand public-sector meetings.
One elderly taxpayer welcomed the idea.
"I've been trying to renew something on a government website for six weeks. If hackers have shut the whole thing down, at least now I know there's a reason."
The government is reportedly considering a new cybersecurity slogan: Your Data Is Safe Because Our Website Doesn't Work.
AI Cyberattacks and AI Defence End Up on the Same Payroll
The most striking development is that artificial intelligence now plays a part on both sides of the cybersecurity battlefield.
AI tools have helped researchers identify and investigate the PHP vulnerabilities, while attackers have used AI-assisted automation to speed up their own operations.
Silicon Valley has therefore achieved a breakthrough: selling the world machines that create problems requiring the purchase of more machines.
The business model will be familiar to anyone who has dealt with a printer manufacturer.
First the company sells you a printer. Then it sells you ink. Then it sells you a subscription so the printer can recognise the ink. Finally it sells you a support plan because the printer no longer recognises its own existence.
Artificial intelligence has simply scaled the idea up to global infrastructure.
One machine finds your security vulnerability.
Another exploits it.
A third writes a detailed explanation of the vulnerability.
A fourth schedules a meeting to discuss the first three machines.
And somewhere in London, a human employee is told to change their password for the seventeenth time this month.
Tech Executives Promise Cybersecurity Investment, Starting With Slides
The cybersecurity emergencies have prompted demands for better software maintenance, stronger authentication and greater corporate accountability.
Industry executives agree that immediate action is essential, particularly action involving consultants, working groups, strategy papers and expensive conferences in attractive European cities.
Paying the people who maintain essential open-source software remains a more controversial proposal.
"Funding maintenance doesn't give shareholders the same thrill as announcing a revolutionary new platform," explained a technology investment strategist.
"You can't impress investors by telling them the existing computer system still works. You have to tell them you're replacing it with something that can predict what customers want before customers know they're being charged for it."
Consumers, meanwhile, have been advised to use stronger authentication, keep unique passwords and be careful with suspicious messages, much as the NCSC's password guidance has said for years.
Businesses should make sure vulnerable PHP installations are patched and review the third-party application permissions in their cloud environments.
The most effective long-term protection, however, might be persuading the technology industry to spend slightly less money inventing digital refrigerators that insult their owners and slightly more paying programmers to maintain the actual internet.
Internet Survives as Executives Announce 14 New AI Products
As cybersecurity teams kept patching vulnerable systems, the technology industry reassured consumers that everything was under control.
The internet had not collapsed completely.
Financial transactions continued. Emails arrived. Social media users kept their constitutional right to argue with strangers about sandwiches.
And millions of websites carried on running, thanks in large part to people doing the deeply unfashionable work of maintaining existing technology.
An industry spokesperson offered a reassuring conclusion.
"The public should understand that no technological system is completely secure. However, we are confident that with continued investment in artificial intelligence, more sophisticated cybersecurity solutions and a significantly larger executive compensation package, we can meet these challenges."
Asked whether the industry might consider giving more financial support to the people maintaining PHP, the spokesperson appeared confused.
"Pay the maintenance people? But they've already shown they can operate without much money."
The internet survived another day.
The hackers returned to their computers.
The executives returned to their presentations.
And somewhere, the person maintaining critical software infrastructure received another email asking whether she would consider doing more with less.
The email ended with a security warning: "This message originated outside your organisation."
So did most of the world's problems.
15 Humorous Observations About the Internet Security Meltdown
- The whole internet runs on security designed by a guy who keeps his house key under a flowerpot labelled "HOUSE KEY."
- Hackers can try 2,900 logins a minute. Meanwhile I need forty-five minutes and a trip to the branch to convince my own bank that I'm me.
- About 70% of websites run on software with serious security flaws. The other 30% are held together with chewing gum and prayer.
- AI is hacking the computers, and AI is fixing the computers. We're just the referee at a robot boxing match, and nobody's checking our ID either.
- Companies spent billions moving everything to the cloud. Turns out the cloud is somebody else's computer with a really popular front door.
- The PHP Foundation has one full-time employee. Eight billion people on the planet, and internet maintenance lost the staffing argument to a Starbucks.
- Experts warn that hackers never forget a password. Well, no. They're using yours.
- Websites went offline to protect themselves from hackers. Genius. Nobody can steal your data if nobody can use your website.
- Governments spent decades telling us to go digital. Their emergency plan is finding out who's got the printer.
- A hacker can get into a corporate network in a few hours. You still need three signatures to change the office wallpaper.
- Microsoft security alerts come in so fast you barely have time to ignore the last one.
- The internet promised freedom and decentralisation. Now half the planet depends on the same handful of companies remembering to hit "update."
- The cybersecurity industry sells you peace of mind for a monthly fee. Peace of mind not included.
- Companies make you pick a password with capitals, numbers, punctuation and a hieroglyph. Then the hackers steal the login of some app everybody already trusts and stroll right in.
- Worldwide emergency, and management still won't raise the maintenance budget. That might be the greatest technological achievement in human history.
Disclaimer
This article is political and technological satire inspired by genuine cybersecurity reporting. The hacking campaigns, PHP vulnerabilities and PHP Foundation staffing figures are based on published reporting. Comic quotations, conversations and institutional reactions are satirical constructions rather than documented statements. References to 2,250 tenants describe the reach of attempted or observed malicious activity, not 2,250 confirmed successful breaches. This disclaimer is maintained by a single unpaid volunteer who last took a holiday during the Blair government, giving it roughly the same resilience as the rest of the internet; sturdier reading is listed in our guide to news satire sites.
This story is entirely a human collaboration between two sentient beings: the world's oldest tenured professor and a philosophy major turned dairy farmer. https://prat.uk/?p=54475
Comments
Post a Comment