Advances in artificial intelligence have uncovered a stream of new software vulnerabilities that are almost certain to trigger more disruption of the kind that spread across government websites this week, seven cybersecurity professionals told Reuters in a report published on October 23. AI helped drive a doubling of the number of digital flaws discovered year-on-year, according to research due to be published in the coming days by VulnCheck, a Massachusetts-based threat intelligence firm.
Matthew Prince, the chief executive of the digital infrastructure firm Cloudflare, told Reuters he was aware of “a bunch of additional severe vulnerabilities that are present in other pieces of critical software” and predicted busy months ahead as AI surfaces long-hidden weaknesses in the fabric of the internet. “I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,” Prince said in an interview on Thursday.
The PHP Scramble That Started The Week’s Outages
The immediate trigger was the discovery of weaknesses in PHP, the venerable programming language that powers a huge swath of the internet. As GEroundtable reported when AI models helped find the two critical PHP flaws dubbed PHP2Shell, and again as millions of exploit attempts hit the web and governments rushed to patch, operators have been racing to fix their software ahead of mass exploitation. Reuters reports that because some felt they could not patch before hackers jumped in, a subset simply yanked their sites offline until they could make them safe.
VulnCheck researcher Patrick Garrity told Reuters the PHP scramble came in an already busy week: disclosures of vulnerabilities in the PHP alternative Node.js and the streaming program Plex, breaches tied to the AI gateway LiteLLM and the development platform Railway, and the revelation that Indian certificate authority eMudhra had used an extraordinarily flimsy cryptographic key. “I think there’s going to be a lot more fire drills for anything that’s internet exposed,” Garrity said.
AI Has Collapsed The Timeline From Discovery To Exploit
Finding bugs used to require skilled human work, and turning one into an exploit, a working digital lockpick, could take weeks or months. That gave defenders breathing room to fix bugs and gently roll out updates.
AI has effectively thrown those assumptions out, Reuters reports. Models can find one bug after another by subjecting codebases to round-the-clock scrutiny, and can turn around exploits in hours. Shane Fry, chief technology officer of Virginia-based RunSafe Security, said the performance of AI models over the past few months had laid to rest any doubts over whether they would change the industry. “What’s fundamentally, and unquestionably, changing is the timescale for not only finding vulnerabilities, but how quickly adversaries can weaponize them,” Fry said.
Not Everyone Expects A Hacker Free-For-All
All the experts Reuters spoke to agreed that defenders’ timelines are getting shorter, but they were split on whether AI leads to a hacker free-for-all. Daniel Stenberg, the lead developer of the file transfer tool curl, argued the vulnerabilities found by AI models tended to be exotic bugs that were difficult for rogue actors to take advantage of. Ramy Rahman, a senior principal solutions engineer at the cybersecurity company ArmorCode, said “more disclosed vulnerabilities do not automatically mean more successful attacks”.
There was tentative evidence of that around the PHP vulnerability. Threat intelligence firm Hunt.io said it had seen aggressive attempts to exploit the bug, but its head of research, Esteban Borges, said that as of 2 p.m. Eastern Time on Thursday the cybercriminals he tracked appeared to have failed to build a working tool for it. Prince told Reuters he had seen anecdotal evidence of compromises linked to the flaw. VulnCheck’s own earlier analysis points the same way as the sceptics: of 1,061 vulnerabilities linked to AI-assisted discovery, only 14, or 1.3%, had been confirmed as exploited in the wild, roughly the overall rate for all vulnerabilities, according to Infosecurity Magazine’s report on the firm’s State of Exploitation research.
Why It Matters
AI-discovered bugs change the working calendar of everyone who runs software. Maintenance windows planned weeks ahead become emergency responses measured in hours, and the safest move for a government website this week was, repeatedly, to switch itself off. The same capability cuts the other way when defenders use it first, as Anthropic showed this week when Claude formally verified 123 open-source libraries and found bugs fuzzing never caught. Prince compared the deluge to slaying the monsters in a haunted house: scary, but better than leaving them lurking behind closed doors. “The reality is, we’re going to get a lot of this stuff cleaned up,” he said.
Background
Vulnerability research was for decades a manual craft, and serious flaws surfaced at a pace the patching system could absorb. Frontier AI models changed the scale of that work during 2026, scanning entire codebases continuously and producing findings, from Anthropic’s Project Glasswing to the AI-assisted discovery of the PHP2Shell flaws, faster than disclosure and patching were designed to handle. VulnCheck’s forthcoming research, showing a year-on-year doubling of discovered flaws, is the first hard measure of how large that change has become.
Source: Reuters, Infosecurity Magazine
0 Comments