Cybersecurity specialists say advances in artificial intelligence are uncovering a steady stream of new software weaknesses, and that more disruption like this week’s outages is almost certain. Seven cybersecurity professionals made the case in interviews, pointing to the failures that spread across government websites in Europe and elsewhere beginning on Wednesday.
Research from VulnCheck, a threat intelligence firm based in Massachusetts, is due to be published in the coming days. According to the firm’s findings, AI has helped double the number of digital flaws discovered compared with a year earlier.
AI brings long-hidden weaknesses into view
Matthew Prince, chief executive of the digital infrastructure company Cloudflare, said he knows of a number of other serious flaws in critical software. He predicted a busy period ahead as AI exposes weaknesses that have been buried in the internet’s underlying structure for years.
Also read: PHP Flaws Force Government Websites in Europe Offline
In an interview on Thursday, Prince described what he expects in the near future. “I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,” he said.
The government site failures were tied to weaknesses found in PHP, a long-established programming language that runs a large share of the internet. Once the flaws became known, operators raced to repair their software before attackers could exploit them. Some organisations felt they could not apply patches in time, so they took their sites offline until they could be secured.
A crowded week for PHP, Node.js and Plex
VulnCheck researcher Patrick Garrity said the scramble over PHP unfolded during an already hectic week in cybersecurity. Over the same days, vulnerabilities were disclosed in Node.js, a rival tool to PHP, and in the Plex streaming program.
The week also brought breaches linked to LiteLLM, an AI gateway, and to Railway, a development platform. Separately, it emerged that eMudhra, an Indian certificate authority, had relied on an extremely weak cryptographic key, which could have put users across the internet at risk.
Garrity said that if similar problems appeared at that pace every week, he would expect a sharp rise in incidents. He added that organisations should expect many more emergency responses for any system exposed to the internet.
Modern software runs on sprawling codebases, and the mistakes known as bugs that open the door to attacks often appear in places nobody expected. Until recently, finding such bugs required a solid level of skill. Turning them into working attacks, known as exploits, could take an experienced professional weeks or months.
That gap once gave defenders some room to fix problems and roll out updates at a measured pace. AI has largely removed that margin. Models can comb through codebases around the clock, find one bug after another, and produce exploits within hours.
Experts divided on a surge in attacks
Shane Fry, chief technology officer of RunSafe Security, based in Virginia, said the performance of AI models over recent months had settled any doubt about whether they would transform the industry. He said the change was clear.
“What’s fundamentally, and unquestionably, changing is the timescale for not only finding vulnerabilities, but how quickly adversaries can weaponize them,” Fry said.
All of the experts agreed that the time defenders have to respond is shrinking. They did not agree on whether AI would lead to a free-for-all among hackers. Daniel Stenberg, lead developer of the file transfer tool curl, argued that bugs found by AI models tended to be unusual and hard for malicious actors to exploit.
Ramy Rahman, a senior principal solutions engineer at the cybersecurity company ArmorCode, took a similar line. “More disclosed vulnerabilities do not automatically mean more successful attacks,” he said.
Early signs around the PHP flaw offered some mixed evidence. Threat intelligence firm Hunt.io said it had seen aggressive attempts to exploit the bug, as had Amazon and Cloudflare. However, its head of research, Esteban Borges, said that by 2 p.m. Eastern Time on Thursday (1800 GMT), the criminals he tracked appeared to have failed to assemble a working tool to use it.
Prince said he had seen anecdotal evidence of compromises linked to the PHP vulnerability. Even so, he argued that the wave of AI-driven discoveries could be unsettling for the industry but would be beneficial overall. He compared the process to clearing out monsters in a haunted house. Facing them may be frightening, he said, but leaving them hidden behind closed doors would be much worse.
“The reality is, we’re going to get a lot of this stuff cleaned up,” he said.
