AI Keeps Finding Software Flaws. Experts Say the Patching Race Is Now Permanent

October 25 — Seven cybersecurity experts interviewed by Reuters believe that, as AI keeps exposing hidden security flaws in software, events like this week’s wave of government websites going down across many parts of the world are almost certain to happen again.

Research soon to be published by VulnCheck, a cyber threat intelligence firm in Massachusetts, shows that AI drove an increase in the number of software vulnerabilities found, with discoveries over the past year doubling year on year.

Matthew Prince, CEO of the digital infrastructure company Cloudflare, said: “I know there are plenty of serious vulnerabilities still in other critical software… I think for the next two years, every week we will feel like the sky is falling.”

He expects the cybersecurity industry to be exceptionally busy over the coming months as AI uncovers long-hidden weaknesses in internet infrastructure one after another.

This week, government websites across Europe and elsewhere went down one after another after a security vulnerability was found in PHP, an old programming language used widely across the internet. Site operators rushed to patch their software to stop hackers exploiting the flaw at scale. Some, worried that they could not patch in time, simply shut their sites down and planned to restore them once it was safe.

VulnCheck researcher Patrick Garrity noted that the emergency patching triggered by the PHP flaws has made an already busy cybersecurity industry even busier. This week, Node.js — a PHP alternative — and the streaming software Plex were also disclosed as vulnerable, while the AI gateway LiteLLM and the development platform Railway were caught up in security breaches.

In addition, India’s digital certificate authority eMudhra was found to be using extremely weak cryptographic keys, potentially endangering users around the internet. “If four or five such incidents happen in a single week, there will probably only be more from now on. As long as a system is connected directly to the internet, it may need ever more frequent emergency handling.”

Modern software codebases are enormous, and bugs hide in unexpected places; some of those flaws are enough to become a way in for attackers.

In the past, finding a vulnerability took some technical skill, and turning it into an attack tool capable of breaking into a system usually took an experienced technician weeks or even months. That long development gave defenders breathing room: they could use the time lag to patch and roll out software updates gradually.

AI has broken that time lag. AI models can inspect software code around the clock, find flaws one after another, and develop exploit programs in just a few hours.

Sean Fay, CTO of the Virginia-based security firm RunSafe Security, pointed out that in recent months AI models have shown in practice that the cybersecurity industry must change as a result. “What has changed fundamentally, and beyond dispute, is time. Not only the time needed to find vulnerabilities, but the speed at which attackers turn them into attack methods.”

The experts interviewed by Reuters agree that defenders have less and less time to patch. But they remain divided on whether AI will cause a flood of hacking attacks.

Daniel Stenberg, lead developer of the file-transfer tool curl, argues that the vulnerabilities AI models find tend to be peculiar and hard for malicious attackers to exploit.

Rami Rahman, a senior principal solutions engineer at the security company ArmorCode, also noted: “More disclosed vulnerabilities do not mean successful cyber attacks necessarily increase along with them.”

This week’s PHP vulnerability, which drew global attention, offers some preliminary evidence. Threat intelligence firm Hunt.io says that, like Amazon and Cloudflare, it also saw intense attempts to exploit the flaw. But Esteban Borges, Hunt.io’s head of research, noted that as of 14:00 US Eastern time on Thursday, its tracking showed that criminals had still not built an effective tool that could actually exploit it.

Cloudflare’s Prince, however, has “seen” scattered signs of systems being compromised, indicating that those breaches are connected to the PHP flaw. In his view, although AI finding a flood of vulnerabilities will hit the cybersecurity industry, in the long run the benefits still outweigh the harm.

He compares the process to clearing monsters out of a haunted house: confronting the monsters is frightening, but leaving them hiding behind closed doors is far worse. “The reality is that we will be able to clear a lot of security risks.”