Artificial intelligence is accelerating the process of discovering software vulnerabilities, reducing the time allocated for their remediation. Cybersecurity experts polled by Reuters predict new disruptions in digital services as companies and governments attempt to prepare for the exploitation of these flaws.
A study conducted by VulnCheck, scheduled for publication in the coming days, shows that the number of discovered digital vulnerabilities has doubled compared to the previous year. Issues registered this week on European government websites demonstrate the pressure such discoveries can cause.
Disruptions began on Wednesday after vulnerabilities were found in PHP, a programming language used in many parts of the internet. To prevent attacks, operators rushed to fix their systems. Some temporarily took sites offline because they could not apply updates before potential intrusions.
This race for fixes occurred during a week already marked by other security issues. Vulnerabilities were disclosed in Node.js and Plex, as well as incidents related to the AI platform LiteLLM and the development platform Railway. The Indian certification authority eMudhra also drew attention due to the use of an extremely weak cryptographic key, which could have jeopardized internet users.
Matthew Prince, CEO of Cloudflare, told Reuters that he is aware of other serious vulnerabilities in software critical to network operation. In his assessment, the sector will face difficult months ahead. He noted: 'I think we will have several years where it feels like the sky is falling every week.'
Previously, searching for vulnerabilities in complex programs required specialized knowledge. Developing tools to exploit them could take weeks or months, giving system administrators time to prepare fixes and distribute updates. However, artificial intelligence is shortening this timeframe. Models are capable of continuously analyzing large codebases, finding issues, and helping develop exploitation tools in just a few hours.
Shane Fry, CTO of RunSafe Security, emphasized the change in the pace of this process. He stated: 'What is fundamentally and undeniably changing is the time required both to discover vulnerabilities and for adversaries to be able to exploit them.'
In light of this situation, security teams must handle tasks that go beyond simply identifying code errors. Specialists are concerned about the reduced response time, but there is no consensus on whether accelerated vulnerability discovery will lead to a wave of successful attacks.
Daniel Steinberg, lead developer of the curl file transfer tool, notes that some vulnerabilities found by AI models are complex and difficult to exploit. Rami Rahman from security company ArmorCode also points out that publishing more vulnerabilities does not necessarily mean an increase in successful attacks. The PHP case serves as an example of this difference: threat intelligence firm Hunt.io discovered aggressive exploitation attempts but reported that by 2 PM Eastern Time on Thursday, the tracked attackers had apparently not yet managed to develop a functional tool to use this vulnerability.
Prince mentioned signs of intrusion related to the vulnerability. Nevertheless, he believes that accelerated problem discovery can bring long-term benefits by allowing the fixing of errors that have remained hidden for years.