Advances in artificial intelligence are exposing previously undetected software vulnerabilities, raising concerns among cybersecurity experts that more disruptions could hit internet services and government websites as hackers seek to exploit the weaknesses.
Seven cybersecurity professionals who spoke to Reuters warned that the growing number of flaws uncovered by AI could trigger further disruptions similar to the outages affecting government websites across Europe and other regions this week.
Research by Massachusetts-based threat intelligence firm VulnCheck, scheduled for publication in the coming days, indicates that the number of digital vulnerabilities discovered annually has doubled, partly driven by advances in AI.
Cloudflare Chief Executive Officer, Matthew Prince, said he was aware of “a bunch of additional severe vulnerabilities that are present in other pieces of critical software” and predicted a challenging period as AI continues to uncover weaknesses in systems that underpin the internet.
“I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,” Prince said in an interview on Thursday.
The latest concerns follow the discovery of vulnerabilities in PHP, a widely used programming language that supports a substantial portion of the internet.
The weaknesses prompted operators of affected systems to rush out security fixes, while some organisations temporarily took their websites offline because they feared hackers could exploit the flaws before repairs were completed.
VulnCheck researcher Patrick Garrity said the PHP disclosures came amid several other cybersecurity incidents, including vulnerabilities affecting Node.js, an alternative to PHP, and Plex, a streaming programme.
The week also saw breaches linked to AI gateway LiteLLM and software development platform Railway.
Separately, Indian certificate authority eMudhra was found to have used a weak cryptographic key that potentially exposed internet users to security risks.
“If we just saw four or five things like this, this week, I would expect we’re going to see a lot more,” Garrity said. “I think there’s going to be a lot more fire drills for anything that’s internet exposed.”
AI speeds up vulnerability discovery
Software systems contain extensive codebases in which programming errors, commonly known as bugs, can create openings for cyberattacks.
In the past, identifying such flaws required considerable technical expertise, while developing tools to exploit them could take experienced specialists weeks or months.
That delay gave organisations time to fix vulnerabilities and distribute security updates before attackers could take advantage of them.
However, cybersecurity experts say AI is rapidly changing that timeline by enabling systems to examine large amounts of code continuously, identify weaknesses and, in some cases, help develop exploits within hours.
Shane Fry, chief technology officer at Virginia-based RunSafe Security, said recent advances in AI had demonstrated its growing influence on cybersecurity.
“What’s fundamentally, and unquestionably, changing is the timescale for not only finding vulnerabilities, but how quickly adversaries can weaponize them,” Fry said.
The faster pace has increased pressure on security teams to identify and fix flaws before malicious actors can exploit them.
Experts divided over hacking risks
Despite agreeing that AI is shortening the time available to respond to security threats, cybersecurity professionals remain divided over whether the technology will inevitably lead to more successful cyberattacks.
Daniel Stenberg, lead developer of the file transfer tool curl, argued that vulnerabilities uncovered by AI models were often unusual and difficult for criminals to exploit.
Similarly, Ramy Rahman, a senior principal solutions engineer at cybersecurity firm ArmorCode, cautioned against assuming that more vulnerability disclosures would automatically result in more attacks.
“more disclosed vulnerabilities do not automatically mean more successful attacks,” Rahman said.
The PHP vulnerability that triggered concern worldwide this week offered some indication of the challenges facing attackers.
Threat intelligence firm Hunt.io said it had observed aggressive attempts to exploit the flaw, similar to activity reported by Amazon and Cloudflare.
However, Hunt.io’s head of research, Esteban Borges, said the cybercriminals he monitored appeared to have been unsuccessful in developing a working exploitation tool as of 2 p.m. Eastern Time on Thursday.
Prince, however, told Reuters that he had seen anecdotal evidence of systems being compromised in connection with the PHP vulnerability.
Despite the immediate risks, the Cloudflare chief executive argued that the growing number of AI-driven discoveries could ultimately improve internet security by forcing organisations to address long-standing weaknesses.
He compared the process to confronting monsters hidden inside a haunted house, saying that although the experience could be frightening, leaving the threats undiscovered would be more dangerous.
“The reality is, we’re going to get a lot of this stuff cleaned up,” he said.
