Artificial intelligence is helping researchers uncover software vulnerabilities at twice last year's rate. It raises concerns about more cyberattacks and internet disruptions, cybersecurity experts told Reuters on October 23. The faster pace is forcing companies and government agencies to fix weaknesses before attackers can exploit them.
Research from Massachusetts-based threat intelligence firm VulnCheck, due to be published in the coming days, points to a doubling in newly discovered digital flaws compared with the previous year.
Cloudflare CEO Matthew Prince warned that further disruptions could follow as AI exposes weaknesses in critical internet infrastructure.
“I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,” Prince said in an interview on Thursday.
Government websites across Europe and elsewhere experienced outages beginning Wednesday after researchers identified weaknesses in PHP, a programming language used across a large part of the internet. Some operators took websites offline while preparing security fixes, fearing attackers could exploit the flaws first.
The same week brought vulnerability disclosures involving Node.js and Plex, alongside breaches linked to AI gateway LiteLLM and development platform Railway. Security concerns also emerged over a weak cryptographic key used by Indian certificate authority eMudhra.
AI tools can examine large codebases continuously and identify flaws that might escape conventional checks. Experts say the technology can also help attackers develop working exploits in hours, reducing the time available for defensive action.
RunSafe Security Chief Technology Officer Shane Fry said, “What's fundamentally, and unquestionably, changing is the timescale for not only finding vulnerabilities, but how quickly adversaries can weaponize them.”
Security specialists disagree on whether the surge in discoveries will produce more successful attacks. Curl developer Daniel Stenberg said some AI-identified flaws may be difficult for criminals to exploit. ArmorCode executive Ramy Rahman also cautioned that more disclosures do not automatically translate into more breaches.
Hunt.io reported attempts to exploit the PHP weakness, though its researchers had not observed a working attack tool by Thursday afternoon US Eastern Time.
Prince said the growing number of discoveries could ultimately improve security by forcing long-standing weaknesses to be fixed. He argued that exposing hidden flaws now could help make internet infrastructure safer over time.
Also Read: Microsoft Device ID Helped Identify Hacker, Raising Fresh Questions on Windows Privacy