AI Discovers New Cyber Vulnerabilities, Increasing the Risk of Attacks on Websites
WASHINGTON — Advances in artificial intelligence (AI) are speeding up the discovery of software vulnerabilities and increasing the risk of disruption to internet services. The situation is seen as posing a serious threat to global digital infrastructure. Seven cybersecurity experts interviewed by Reuters warned that it could lead to more disruptions like those affecting government websites in several countries this week.
Research by Massachusetts-based cyber threat intelligence firm VulnCheck shows that the number of digital security flaws discovered has doubled year on year. The research is due to be published in the coming days.
Cloudflare chief executive Matthew Prince said he was aware of several other serious vulnerabilities in important software. He said AI’s ability to uncover weaknesses that had previously remained hidden could make the coming months a busy period for the cybersecurity industry.
“I think we’re going to have a few years where every week feels like the sky is falling,” Prince said in an interview on Thursday (23 October), Reuters reported on Friday (24 October).
Widespread disruption to government websites in Europe and elsewhere since Wednesday followed the discovery of a flaw in PHP, a programming language widely used on the internet. System operators rushed to patch their software in anticipation of mass exploitation. Some administrators even chose to take their websites offline temporarily, fearing they would not have time to install the fix before hackers exploited the vulnerability.
VulnCheck researcher Patrick Garrity said the effort to patch the PHP vulnerability came during a week already crowded with cybersecurity problems.
In the same week, vulnerabilities were also disclosed in Node.js, an alternative to PHP, and Plex, software used for streaming services. There were also security incidents involving LiteLLM, an AI gateway, and Railway, a software development platform. India’s digital certificate authority, eMudhra, was also found to be using extremely weak cryptographic keys, putting internet users at risk.
“If we’re seeing four or five things like this in one week, I expect there will be more,” Garrity said. “I think there will be more emergency situations for everything connected to the internet.”
AI Shortens the Time Needed to Find and Exploit Vulnerabilities
The codebases underpinning modern software are vast. Programming errors, or bugs that create opportunities for exploitation, can appear in unexpected places.
Before AI advanced, finding vulnerabilities required specialist skills. Creating an exploit—a tool for taking advantage of a flaw—could also take experienced professionals weeks or months.
That time gave system operators an opportunity to fix vulnerabilities and roll out software updates in stages.
AI, however, is changing that. AI models can continuously inspect codebases for vulnerabilities and help develop exploits in a matter of hours.
RunSafe Security chief technology officer Shane Fry said the capabilities demonstrated by AI models in recent months had made the changes under way in the cybersecurity industry clear.
“What has fundamentally and indisputably changed is the timeframe—not just for finding vulnerabilities, but also how quickly adversaries can weaponise them,” Fry said.