Two forced investments, one scarce currency: why the next enterprise technology supercycle has already begun.
A system still works. Customers can use it. Revenue keeps flowing. Replacing it would be expensive and disruptive, so the upgrade moves into next year’s budget, and then into the year after that.
Every such decision rests on an assumption: that the consequences of waiting will remain manageable. For most of the past twenty years that assumption held. In October 2026 it stopped holding, and the moment deserves a larger name than a security incident.
My argument is this. Enterprises now face two technology investments at once. They have to repair the foundations they spent two decades deferring, because AI has changed the cost of leaving them alone, and they have to fund the AI capabilities that their competitors are building on better foundations. The two demands arrive together, they draw on the same scarce input, and together they will produce a technology investment supercycle: a multi-year period in which enterprise technology spending grows structurally faster than the revenues that fund it. The currency of that cycle is compute, and compute is rationed.
What October showed
On 21 October 2026, PHP shipped emergency fixes for two vulnerabilities that allow unauthenticated remote code execution in the language’s core, before any application code runs. PHP serves roughly 69% of the websites whose server-side language W3Techs can identify. The flaws had been present for more than a decade, and every PHP version released in that time was affected by at least one of them.
The important fact is not the severity. It is how the flaws were found, and by whom. The security firm Calif found the first of them in August, using OpenAI’s GPT-5.6 Sol during an audit of PHP’s source code that OpenAI funded. Weeks later, Wiz Research found the same flaws independently, using Gemini 4 Argon and GPT-5.6 Sol, and reported them to PHP on 24 August. Two teams and two model stacks reached the same decade-old flaw within weeks of each other. Wiz’s own description is precise: the models “substantially reduced that barrier, turning a longstanding flaw into an exploit.”
Then came the part that matters for this essay. Fixes went to PHP 8.2 through 8.5, with backports to the unsupported 7.4, 8.0 and 8.1 branches. W3Techs puts 26.8% of PHP sites on version 7 and a further 7.7% on version 5, versions that reached end of life years ago. Roughly a third of the world’s PHP estate was therefore running versions past end of life, and anything older than 7.4 received no fix at all. The exploit exists, the patch exists, and a large part of the estate cannot apply it. That is what technical debt looks like when the bill arrives.
An enterprise can leave its software untouched and still become materially less secure, because the capability of whoever is attacking it has changed. That is the new calculation for a board that has accepted another year of delay. The PHP Foundation makes the practical point that tools can find bugs faster but experienced engineers must still weigh compatibility, choose fixes and review them, and no amount of compute removes that responsibility. The deeper lesson is that an enterprise needs to know what it depends on and be able to change it safely. A patch published somewhere in the supply chain offers little comfort if applying it would break a business-critical service.
How the debt accumulated
Technical debt is more than old code. It is unsupported components, fragile integrations, dependencies nobody fully understands and changes nobody can confidently test. Each year of deferral was individually rational, because remediation always cost more in the year it was proposed than the risk it removed. Compounded over two decades across every large enterprise, those rational decisions produced a stock of deferred work that nobody chose and nobody owns.
Measuring that stock is hard, and I would rather show the shape than pretend to a precise number. The Consortium for Information and Software Quality has estimated the principal of accumulated US software technical debt in each of its reports: about $0.54 trillion in 2018, $1.31 trillion in 2020 and $1.52 trillion in 2022, the last increase attributed largely to deficiencies that were never fixed. The methodology changed between the first two reports, so the early jump overstates growth, but the direction is not in doubt and the figure covers one country. The same reports projected that 40% of IT budgets would be spent maintaining debt by 2025, and Deloitte’s March 2026 analysis puts the burden at 21–40% of organisational IT spending today.
What AI changes is the interest rate on that debt. The principal was always there; the cost of carrying it was set by how hard it was for an adversary to exploit it, and that cost has just fallen. AI also reduces the cost of paying the debt down. Amazon’s account of using Amazon Q to upgrade tens of thousands of Java applications, with an estimated 4,500 developer-years avoided, is a vendor’s figure for a single migration, but it shows that renewal at scale is no longer purely a human-labour problem. Both halves of the equation have moved at once: the debt is more dangerous to carry and cheaper to retire. That is why it is being called in.
Two demands, one budget, one precedent
The budget data already show where this is heading. Deloitte’s 2025 tech value survey of nearly 550 leaders found digital budgets rising from 8% of revenue in 2024 to 14% in 2025, with AI taking an average 36% of those budgets. Deloitte then extrapolated that at the same pace organisations would see digital budgets reach 32% of revenue by 2028. Deloitte presented that as arithmetic rather than forecast, and I treat it as the ceiling case. My argument is that the two forces in this essay are the mechanism that could make the ceiling case real: a remediation bill that can no longer be deferred, and an AI build that cannot be deferred either.
The squeeze is already visible in next year’s budgets. Forrester expects AI to take one dollar in five of business technology spending in 2027, yet only 53% of technology leaders expect their next budget increase to beat inflation. Enterprises will carry the cost of the transition before they can fund it from the transition’s gains.
The precedent. In the late 1990s enterprises were forced to remediate a specific and well-understood accumulation of technical debt, the two-digit year, at a cost Gartner estimated at $600 billion worldwide and the US Department of Commerce put at $100 billion for the United States alone. The forced remediation landed in the same years as the internet build-out, and the two together produced the last enterprise technology supercycle. The structure now is the same. AI-enabled exploitation forces the remediation, and AI itself is the new platform. The difference is that Y2K had a date and this one does not. It arrives for each enterprise on the day its oldest exploitable flaw becomes cheap to find.
Compute is the currency, and it is rationed
Both programmes consume the same input. Enterprises will spend compute to understand and test changes to old systems and to investigate threats against them, and they will spend it every time an agent reasons, calls a tool or carries out a business process. Some of that spending buys infrastructure; much of it arrives through cloud, software and service bills. Deloitte’s AI infrastructure survey found 86% of leaders expecting AI infrastructure budgets to rise over three years, with budgets expected to more than triple, and 61% expecting to consume more than ten billion tokens a month by 2028.
The constraint is physical and it is not short. Gartner’s October forecast records that data-centre demand has driven memory prices to more than double, an effect its analyst calls “memflation” and expects to persist through 2027. Apollo’s June analysis describes on-demand GPU capacity as “effectively sold out,” with the fabs and power equipment behind it committed for years ahead.
That is the sense in which compute becomes the currency of this cycle. Organisations now buy machine effort alongside human effort, and the supply of machine effort is allocated rather than simply purchased. Those who have secured capacity will modernise and build on their own timetable. Those who have not will face rationing, slower deployment or higher prices for both programmes at once. Cheaper tokens will not rescue them, because lower unit costs expand the work worth attempting without guaranteeing a smaller bill, and Deloitte’s own research warns that token growth can reflect inefficient design as easily as useful work. The measure that matters is the cost of a successfully completed task, including the checking it requires.
The counter-argument
If technology spending rises from the high single digits toward the teens as a share of revenue, and revenue does not grow at that pace, the money comes from the rest of the cost base, and the largest line in most cost bases is people. That is the honest counter-argument, and it should be stated as arithmetic rather than prophecy. McKinsey’s latest survey found 39% of respondents expecting AI-related workforce reductions in the coming year, while only 14% reported actual reductions over the preceding year. The pressure is real and the outcome is not settled. The particular danger is cutting the people who understand the systems being renewed, whose knowledge is what makes an AI-generated change safe to accept. Enterprises will need to tell the work that can be automated from the expertise that makes automation safe.
The bill is due
This cycle will be uneven. Some enterprises will renew selectively and secure the compute they need, releasing resources for growth. Others will accumulate new AI costs on top of unresolved legacy costs and discover that both bills are priced in a currency they did not secure. What has expired is the assumption that the past can wait while the future is funded. On 21 October a patch was published for a decade-old flaw, and a third of the world’s PHP estate was still running versions past end of life. The debt has been called in, and the first instalment is being paid in compute.
Sources and evidence notes
Research checked through 25 October 2026. The supercycle thesis is the author’s. Forecasts, survey expectations, extrapolations and company-reported results are identified as such in the text; they are not realised market outcomes.
- Wiz Research, PHP2Shell: AI uncovers critical RCE vulnerabilities. 21 October 2026; discovery timeline and the quoted sentence on frontier models.
- The Next Web, PHP rushes out emergency patches for two critical bugs AI found first. October 2026; Calif discovery with GPT-5.6 Sol, patched and backported branches.
- The PHP Foundation, Today’s PHP security release and how we are strengthening PHP security. 21 October 2026.
- W3Techs, Usage statistics of PHP for websites, with version breakdown. snapshot accessed 25 October 2026; version shares are of websites that use PHP.
- CISQ, The Cost of Poor Quality Software in the US: a 2018 report. 2018; technical debt principal derived from a CAST global estimate.
- CISQ, The Cost of Poor Software Quality in the US: a 2022 report. November 2022; 2020 and 2022 technical debt estimates and the 2025 budget projection.
- Deloitte, Technical debt’s penalty on value and growth. 27 March 2026.
- AWS, Amazon Q Developer just reached a 260 million dollar milestone. 1 August 2024; company-reported estimates.
- Deloitte, Digital budgets are rising, but investment strategies may need a recalibration. 16 October 2025; 548 leaders; the 32% figure is Deloitte’s extrapolation.
- Forrester, Predictions 2027: Disruption unleashed. 21 October 2026.
- Gartner, Gartner forecasts worldwide IT spending to grow 15% in 2027, totaling $7.35 trillion. 21 October 2026; includes the memory price statement.
- McKinsey, The state of AI in 2026: on the road to ROI. 25 August 2026; 1,719 respondents.
- US Senate Special Committee on the Year 2000 Technology Problem, Investigating the impact of the Year 2000 problem. 1999; cites Gartner’s $600 billion worldwide estimate.
- Computerworld, Some key facts and events in Y2K history. US Department of Commerce estimate of at least $100 billion, November 1999.
- Deloitte, Enterprise AI infrastructure survey: a 2028 outlook. 30 March 2026; 515 US leaders surveyed November to December 2025.
- Apollo, The growing compute shortage. 15 June 2026.
Personal views, not those of my employer.