American Express attributes app and website disruptions to internal issue amid PHP vulnerability concerns

What caused the disruptions

American Express confirmed on Thursday that disruptions affecting its app and website were the result of an internal technical issue, not a security vulnerability. The company did not disclose how many users were affected, but reports on DownDetector indicated a decline in outage complaints to double digits by the time of the statement.

The disruptions occurred as cybersecurity professionals globally heightened scrutiny of online incidents, linking them to the so-called "Black October" crisis. This crisis stems from recently patched vulnerabilities in PHP, a widely used programming language, which have led to millions of hacking attempts in the past day, according to Cloudflare’s CEO.

Broader cybersecurity concerns

The PHP vulnerabilities have raised alarms across industries, particularly in financial services and emergency response systems. While American Express ruled out a security breach, other incidents remain unexplained. For example, a 911 outage in Oakland, California, late Wednesday has not been tied to the PHP flaws, unlike disruptions in Riverside and Santa Barbara Counties, which were attributed to vandalism of a fiber optic line in Los Angeles.

The financial sector is also responding to emerging threats from AI-driven agents. Major institutions, including Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo, are reportedly taking steps to block AI agents operating independently within user accounts. These measures reflect growing concerns about AI’s role in amplifying cybersecurity risks.

Cybersecurity outlook

Jason D. Clinton, Deputy Chief Information Security Officer at Anthropic, warned that cybersecurity challenges will worsen before improving, with meaningful progress expected in about 18 months. He emphasized the urgency of addressing foundational security practices, particularly as AI introduces new vulnerabilities.

Clinton’s remarks underscore the broader industry trend of grappling with AI’s dual role as both a tool for innovation and a potential security liability. The rush to integrate AI into systems has, in some cases, outpaced efforts to secure them, leaving gaps that cybercriminals are increasingly exploiting.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

For founders and operators, especially in financial services and AI-driven industries, this story highlights two critical pressures: the immediate risk of technical outages—even those unrelated to cyberattacks—and the escalating threat landscape tied to vulnerable foundational technologies like PHP. The fact that major banks are already blocking autonomous AI agents suggests that regulators may soon follow with stricter controls on how AI interacts with user data. Startups building on similar stacks or integrating AI into customer-facing workflows should prioritize redundancy and audit their dependency chains for single points of failure, not just security flaws.

Related on Lazyfounder

• Cloudflare
• Anthropic
• OpenAI’s GPT-6 models improve low-resource language support but raise safety concerns
• More technology news