Jason Clinton, the company's deputy chief information security officer, said on X that newly discovered software flaws could emerge faster than operators can fix them, leaving critical infrastructure vulnerable to attack.

Clinton reiterated his earlier warning of a 'vulnerability tsunami,' urging operators to isolate critical systems from outside networks immediately to protect them from attack. 

He urged companies to strengthen basic defenses immediately, warning that recent cyber incidents were only the beginning.

'As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better,' Clinton wrote on X. 'We need to hold on for ~18 months.'

His comments come amid mounting concerns over the security of websites, essential services and bank accounts as increasingly powerful AI tools expose weaknesses in existing defenses.

Government portals, hospital websites and school services went dark worldwide on Wednesday as operators scrambled to protect against two critical software flaws found in PHP, a programming language used to power up to 70 percent of the world's websites.

A day later, major US banks reported third-party AI agents accessing customer accounts and making transactions.

Clinton reinforced his latest warning by sharing a post he originally published on August 20.

'The vulnerability tsunami is coming in just a few months, and there won't be enough time to patch critical infrastructure,' he wrote.

'Network isolation described below (air-gaps and data diodes!) needed now!'

He was urging operators to separate the computer systems behind essential services from outside networks, making them harder for hackers to reach.

His warning follows a scramble to secure websites against two critical flaws in PHP, a programming language widely used across the web. 

Websites and online services have been temporarily taken offline in several countries, including the Netherlands, Finland, France and Denmark, over fears of an attack.

The US National Security Agency (NSA) and FBI advised organizations using PHP to take affected systems offline if they could not immediately install security updates.

Major US websites and services, including Etsy, Wikipedia and NASA.gov, use PHP-based technology, illustrating the software's reach across shopping, information and government services.