Most of the talk about AI concentration is about circles. A handful of chipmakers, cloud providers and AI labs fund, supply and buy from one another. The Bank for International Settlements found that more than half of all investments in AI firms between 2021 and 2025 came from other AI firms. In a circle, a problem at one firm is passed to the next: a write-down here, a cancelled contract there. Stress travels along the links, and it takes time. A board can, at least in principle, watch it coming.
This week showed a different shape. On 21 October the PHP project released emergency fixes for two critical flaws, now known as PHP2Shell, which can let an attacker take over a web server without logging in. PHP sits under a large part of the web: WordPress, Drupal and Joomla sites, customer portals, admin tools and payment pages. According to Wiz, which helped find the flaws, every version released in the last decade is affected.
That is not a circle. It is a star, like the crack a stone leaves in a windscreen: one point of impact, with lines running out in every direction. Here the centre is one component, and the points are hundreds of thousands of firms, most of which have nothing to do with one another. Nothing passes from firm to firm. Everyone becomes vulnerable at once, through the same weakness.
Three things follow for a board.
The warning can come late, and the window is short. Circles can unravel fast too, but the stress usually shows somewhere first: a funding round that struggles, a contract that is cut. A shared flaw gives no such sign. PHP’s flaws sat in the code for a decade. When the time came, details leaked before the fixes were ready, and one security firm wrote a working exploit in less than a day. Amazon saw an attempt to exploit the flaws four days before they were disclosed, and now says they are being broadly exploited. The flaws themselves were found by researchers using frontier AI models. The same capability that finds flaws for defenders is shrinking the time defenders have to fix them.
Switching does not help. The usual answer to supplier risk is an alternative. In a star failure, the alternative was probably hit the same week, by the same flaw. Your fallback and your main supplier sit in the same blast zone, not because they are tied to each other, but because they stand on the same ground.
Nobody at the centre answers to you. TSMC sits under every leading chip on my AI Blast Zone map, but TSMC is a company, with customers, contracts and shareholders who care. PHP has maintainers, a security team and a foundation, but none of them answers to the firms that depend on it. The foundation says a possible exploit was theorised in 2024, and calls the delay that followed “a structural failure”, caused by its own decision-making and lack of resources. Its security work still depends on “a small group of foundation-funded developers and a little volunteer help”. The dependency matters far more than the resources and accountability behind it. There is no contract to read and no supplier to assess, and it appears on nobody's supplier list.
So the question for a board is not only “who are our suppliers?” It is “what do they all stand on?” Some answers are familiar: a cloud provider, a chip foundry, the power grid. Others, like PHP, stay invisible until the week they fail.
Three practical questions follow:
- Where do we run PHP ourselves, including the marketing site and admin tools nobody has looked at for years?
- Which of our suppliers run PHP, especially those holding our customers' data, and how quickly did they tell us they had patched?
- If one of them was breached before patching, what could we not undo? A defaced website can be restored. Customer data, once taken, cannot be retrieved.
The second question matters most. How a supplier behaves in a week like this tells you more than any annual questionnaire.
Circles spread a failure. Stars deliver it everywhere at once. Most firms stand in both, and few have drawn either.
Sources: BIS Bulletin 137, Circular relationships among AI firms (1 October 2026); The PHP Foundation, Today’s PHP security release (21 October 2026); Wiz Research; Amazon Threat Intelligence; CNBC. Facts as at 23 October 2026.
Richard Anderson
Founder, AndersonRisk