Artificial intelligence is speeding up the discovery of software vulnerabilities, prompting cybersecurity teams to quickly fix and protect internet-facing systems. | Photo credit: Dado Ruvic
Advances in artificial intelligence have uncovered a new stream of software vulnerabilities that will almost certainly lead to another breach along the lines of the widespread disruption of global government websites this week, according to seven cybersecurity professionals who spoke to Reuters.
AI is helping to increase the number of digital vulnerabilities discovered each year, according to research to be published in the coming days by VulnCheck, a Massachusetts-based threat intelligence firm.
Matthew Prince, chief executive of digital infrastructure company Cloudflare, told Reuters he was aware of “additional severe vulnerabilities in other critical software” and predicted busy months ahead as AI uncovers hidden weaknesses in the internet.
“I think we’re going to have a few years where every week is going to feel like the sky is falling,” Prince said in an interview on Thursday.
The widespread outage of government websites in Europe and elsewhere since Wednesday came after the discovery of a weakness in PHP, the venerable programming language that powers much of the internet. Operators have rushed to patch their software in anticipation of mass exploitation and, as some feel they can’t patch before hackers pounce, a subset have simply taken the site offline until they can make it secure.
VulnCheck researcher Patrick Garrity said the scramble to fix PHP comes during an already busy week in cybersecurity. The week also revealed the vulnerability of the PHP alternative Node.js and the Plex streaming program, breaches related to the LiteLLM AI gateway and the Railway development platform, and the revelation that the Indian certificate authority eMudhra had used very thin cryptographic keys that could put users on the internet at risk.
“If we’ve only seen four or five things like this this week, I expect we’ll see a lot more,” Garrity said. “I think it’s going to be more of a fire drill for anything that appears on the internet.”
SHORTENING TIMELINES
The code base that runs modern programs is vast and errors, or “bugs,” that open potential avenues for exploitation often pop up in unexpected places.
Previously, finding bugs required a basic level of skill, and taking advantage of those bugs to build digital lockpicks – called “exploits” – could take weeks or months of work by experienced professionals.
The former would provide defenders with a little breathing room to fix bugs and slowly update the software.
AI effectively throws that assumption out the window. The model can find a single bug by using the codebase to check it every hour, and can modify the exploit in hours. Shane Fry, chief technology officer of Virginia-based RunSafe Security, said the AI model’s performance demonstrated over the past few months has effectively dispelled any doubt that it will change the industry.
“What’s fundamentally, and undeniably, changed is the time scale for not only finding vulnerabilities, but how quickly the adversary can use the weapon,” Fry said.
MONSTERS are scary
While all the experts Reuters spoke to agreed that the defenders’ timeline was shrinking, they were divided on whether AI would lead to a hacker free-for-all.
Daniel Stenberg, lead developer of the file transfer tool curl, said that vulnerabilities found by AI models tend to be exotic bugs that are difficult for malicious actors to exploit. Ramy Rahman, senior lead solutions engineer at cybersecurity firm ArmorCode, said that “more vulnerabilities disclosed do not mean more successful attacks.”
There is tentative evidence of a PHP vulnerability that is attracting worldwide attention this week. Threat intelligence firm Hunt.io says it – like Amazon and Cloudflare – has seen aggressive efforts to take advantage of the bug. But the firm’s head of research, Esteban Borges, said that, as of 2 Eastern Time on Thursday (1800 GMT), the cybercriminals he tracked appeared to have failed to develop the tools they could use to take advantage.
Prince, of Cloudflare, told Reuters that he had seen anecdotal evidence of compromises linked to PHP vulnerabilities.
A flood of AI-driven inventions could impact the industry, but ultimately it will be positive, he said, comparing it to killing monsters in a haunted house.
The confrontation might be scary, he said, but leaving the monsters quietly behind closed doors was worse.
“The truth is, we’re going to clean up a lot of this stuff,” he said.
Published on October 23, 2026