Artificial intelligence tools are accelerating the discovery of vulnerabilities in software used by much of the internet. The shift could help defense teams fix old flaws, but it also reduces the window available to apply updates before criminals attempt to exploit the same issues.
A Reuters report published this Friday, October 23, gathered the assessment of seven cybersecurity professionals. They agree that the pace of discovery and development of exploit code has accelerated, although they differ on how much this will result in truly successful attacks.
More flaws found in less time
Threat intelligence firm VulnCheck reported that the annual number of vulnerability records grew by 100%. The company attributes this jump to a combination of AI tools for locating flaws and the expanded capacity of organizations authorized to assign new CVEs.
VulnCheck’s discovery intake service recorded a tenfold increase in submissions in one year. According to the company, 51% of researchers who submitted reports declared they used AI to find the vulnerability.
These numbers do not mean that AI is the sole cause of the growth. More researchers, more responsible disclosure programs, and greater registration capacity also drive up the amount of documented flaws. The key takeaway is that tasks previously limited to specialists can now be automated and executed continuously.
The case of PHP
The warning gained urgency following the disclosure of critical vulnerabilities in PHP, a programming language present in many websites and applications. OpenAI reported that a researcher from its Patch the Planet initiative found one of the vulnerabilities using an AI model, while the company Wiz independently identified both issues.
PHP maintainers led the preparation of fixes, supported by researchers and infrastructure providers. Organizations were advised to identify vulnerable versions and install applicable updates.
According to Reuters, some operators of government websites in Europe and other regions chose to take services offline while unable to update their systems. The move aimed to reduce exposure during the period between public disclosure and patch application.
The defenders’ window has shrunk
In the traditional model, locating a complex flaw and turning the discovery into a functional attack method could take weeks or months. AI systems can analyze large codebases continuously and assist in creating tests within hours, compressing this timeline.
VulnCheck categorizes the risk across five fronts: vulnerability discovery, exploit development, automated attack coordination, expansion of the attack surface exposed by new tools, and risks inherent to advanced systems.
The problem isn’t just finding more bugs. The same automation that helps security teams review code can make offensive techniques accessible to people with less specialized knowledge. This demands faster patching, updated software inventories, and advance coordination among maintainers, cloud providers, and public agencies.
More alerts do not necessarily mean more breaches
Experts interviewed by Reuters offered an important caveat: a disclosed vulnerability does not equal a successful attack. Some AI-discovered flaws appear in rare conditions or are difficult to turn into a reliable invasion method.
In the recent PHP case, monitoring companies observed aggressive exploitation attempts. At the same time, researchers tracked by Reuters reported that some of the initial attempts failed to produce a functional tool. There were still inconclusive reports of potential compromises.
This contrast prevents two premature conclusions. The first would be to minimize the risk because not every attempt works. The second would be to assert that every new flaw will produce a wave of attacks. The most likely short-term effect is an increase in patching emergencies and preventive outages.
What organizations should do
The recommended response remains grounded in known practices: maintaining version inventories, monitoring alerts from used projects, applying patches as a priority, and reducing the exposure of unnecessary services. Tested backups, traffic monitoring, and response plans also become more critical as reaction time shrinks.
AI can favor both sides of the contest. For defenders, it finds previously invisible issues and helps prepare tests and fixes. For attackers, it can accelerate the search for targets and the adaptation of techniques. The outcome will depend on who acts first and how well vulnerability disclosure is coordinated.
Sources
- Reuters — interviews with cybersecurity professionals
- VulnCheck — analysis on AI vulnerability discovery and exploitation
- OpenAI — coordination of response to PHP flaws
Stock image: server racks in a data center. Credit: Iqdata.center/Wikimedia Commons, CC BY-SA 4.0 license.
