Britain’s National Cyber Security Centre (NCSC) issued an alert on October 21 local time saying that PHP, a scripting language widely used in website development, contains a serious security vulnerability that could be exploited by attackers. Out of caution, institutions in several countries have taken precautionary measures, temporarily taking official websites or public online services offline.
Confirmed actions so far include: the UK Office for Budget Responsibility (OBR) suspending its public website service, Finland temporarily shutting down government public online services, and the Dutch cyber security agency likewise taking its own website offline. The outages were not the result of an actual intrusion but rather risk-control steps taken by each institution before the vulnerability could be patched, though they also reflect how deeply the public sector relies on a single open-source language.
Notably, the vulnerability was not recently written; it lay dormant for more than a decade before being exposed through analysis by artificial intelligence models from OpenAI and Google. In other words, long-standing defects that human audits had struggled to uncover are now being pinpointed by AI in a short time, and the same technology is being used by hackers to speed up the search for openings, creating an arms race in which both attack and defense are escalating at once.
AI security moves from supporting role to center stage
Kaiyuan Securities believes that in the AI era, cyber security has evolved into an “AI versus AI” landscape, giving the industry a new growth window. Market research firm Gartner estimates the global AI security market will grow 69% in 2027 from 2026 to $4.783 billion (about NT$160 billion), and climb further to about $7.7 billion (about NT$250 billion) in 2028.
The main driver of this market is corporate demand to protect AI systems themselves: companies must keep models and agents from being misused, deal with emerging vulnerabilities that AI rapidly uncovers, and strengthen defense in depth against complex threats.
Note: Market size figures are Gartner estimates; New Taiwan dollar amounts are converted at reference exchange rates.
Chinese vendors stake out agent security
Among the listed companies involved, China’s Venustech (002439.SZ) has deeply integrated AI technology into its protection systems, pushing protection capabilities from rule matching toward intelligent cognition, and has developed anomaly behavior detection technology for AI agent attacks, moving detection logic from feature identification to attack-intent recognition.
Chinese firm AsiaInfo Security (688225.SS) is focused on three areas — agent identity security, AI asset governance and trusted agent execution — and has released an agent identity security system as well as the industry’s first agent trust framework, ATF, in an effort to build a security foundation for trusted agent execution.
Impact and outlook
The direct financial impact of the PHP vulnerability incident on the market is limited; the real signal is that the logic of corporate security budgeting is changing. In the past, security procurement was concentrated in traditional items such as firewalls and endpoint detection. Now the security of AI systems themselves, model access control and defenses against AI-generated attacks are being pulled into the front of procurement lists.
For investors, this means the growth story for the security sector will shift from “compliance-driven” to “AI-driven,” but they should also note that AI security remains an early-stage market, with wide gaps between vendors in product maturity and actual revenue contribution, and a time lag between theme enthusiasm and earnings delivery. Kaiyuan Securities’ view leans optimistic, and more corporate earnings reports and order data are still needed to verify it.