Cybersecurity experts have warned that artificial intelligence could lead to further disruptions of websites and online services as the technology uncovers hidden software vulnerabilities that hackers may exploit.
Seven cybersecurity professionals told Reuters that recent advances in AI have accelerated the discovery of security weaknesses, increasing pressure on organisations to repair vulnerable systems before cybercriminals can take advantage of them.
Research by Massachusetts-based threat intelligence firm VulnCheck, due for publication in the coming days, indicates that the number of discovered software vulnerabilities doubled year-on-year, with AI contributing to the increase.
Matthew Prince, chief executive of internet infrastructure company Cloudflare, said several other serious vulnerabilities had been identified in critical software and were currently being addressed. He warned that organizations could face repeated security emergencies over the next few years as researchers uncover weaknesses that have remained hidden for long periods.
The warning follows the temporary shutdown of government websites in Europe and other regions after researchers identified critical flaws in PHP, a programming language used by a large proportion of websites worldwide.
Website operators rushed to install security updates amid fears that hackers could exploit the vulnerabilities. Some organizations temporarily took their websites offline because they could not guarantee their systems would be secured before potential attacks began.
Patrick Garrity, a researcher at VulnCheck, said the PHP incident occurred during an unusually busy period for cybersecurity disclosures.
Other developments included vulnerabilities in Node.js, a software environment used to run JavaScript outside web browsers, and Plex, a media streaming platform. Security breaches were also reported involving AI gateway LiteLLM and software development platform Railway.
Separately, concerns emerged over the use of a weak cryptographic key by Indian certificate authority eMudhra, potentially exposing internet users to security risks.
Garrity said the number of significant vulnerabilities identified within a short period suggested organizations should prepare for more urgent security responses, particularly for systems accessible through the internet.
AI shortens the time available to fix security flaws
Software systems contain millions of lines of code, making it difficult for developers to identify every mistake that could create an opening for attackers.
Before recent advances in AI, discovering vulnerabilities often required considerable technical expertise. Developing an exploit, a tool or method used to take advantage of a weakness, could then take experienced researchers weeks or months.
That process gave software developers time to prepare patches and distribute updates before attackers could exploit the flaws on a large scale.
AI is changing that timeline by allowing researchers to examine large codebases continuously, identify potential weaknesses and, in some cases, develop working exploits within hours.
Shane Fry, chief technology officer of Virginia-based RunSafe Security, said the technology was changing how quickly vulnerabilities could be discovered and turned into tools for cyberattacks.
The development means organizations may have less time to respond once a security flaw becomes known, increasing the importance of monitoring systems and applying patches promptly.
Experts disagree on whether AI will lead to more successful attacks
Although cybersecurity professionals broadly agree that AI is accelerating vulnerability discovery, they differ on whether the trend will necessarily result in a corresponding increase in successful cyberattacks.
Daniel Stenberg, lead developer of the curl file-transfer tool, argued that some vulnerabilities discovered by AI are highly complex and may be difficult for malicious actors to exploit.
Ramy Rahman, a senior principal solutions engineer at cybersecurity firm ArmorCode, similarly cautioned that a rise in disclosed vulnerabilities does not automatically translate into more successful attacks.
The response to the recent PHP flaw offers an early example of the uncertainty surrounding the threat.
Threat intelligence firm Hunt.io reported aggressive attempts to exploit the vulnerability, similar to activity observed by Amazon and Cloudflare. However, Esteban Borges, the firm’s head of research, said that as of 2pm Eastern Time on Thursday, the cybercriminals he was monitoring appeared not to have developed a working exploit.
Prince, however, told Reuters he had seen anecdotal evidence of compromises linked to the PHP vulnerability.
The differing assessments highlight the difficulty of determining how quickly attackers can turn newly discovered weaknesses into successful intrusions.
Experts see long-term benefits despite immediate risks
Despite concerns about the potential for further disruption, Prince argued that the growing use of AI to uncover vulnerabilities could ultimately strengthen internet security by exposing and helping developers repair weaknesses that might otherwise remain undetected.
He compared the process to confronting hidden dangers rather than allowing them to remain undiscovered.
The immediate challenge, however, is ensuring that software developers, businesses and government agencies can respond quickly enough to prevent newly identified vulnerabilities from being exploited.
As AI continues to accelerate security research, experts say organizations will need to strengthen their monitoring and patching processes to keep pace with the shortening time between the discovery of a flaw and its potential exploitation.
Source: Reuters
