A faster cycle for finding and exploiting software weaknesses is compressing the time available to protect internet-facing systems, as recent PHP flaws prompted website shutdowns in Europe and beyond, Reuters reported.
The disruptions started Oct. 21, when flaws in PHP, a programming language used across the internet, came to light. Some operators judged they could not install patches before attackers might exploit the flaws, and took their sites offline while addressing the risk. EconoTimes previously covered the Dutch government and European Patent Office sites affected by the PHP problems.
VulnCheck, a Massachusetts-based threat intelligence firm, is preparing research that Reuters said is expected within days to show software flaw discoveries rose to twice the year-earlier level, with AI contributing. The same week brought vulnerability disclosures involving Node.js and Plex, along with breaches linked to LiteLLM, an AI gateway, and Railway, a development platform. Reuters also reported that eMudhra, an Indian certificate authority, had used a weak cryptographic key that could have exposed internet users to risk.
One pressure point is timing. Software systems rely on large codebases where mistakes can be hidden in unexpected areas, Reuters reported. Shane Fry, chief technology officer of RunSafe Security, said AI's recent capabilities have changed the interval between finding a flaw and preparing an attack. Researchers who once might have spent weeks or months turning a weakness into an exploit can now use AI to accelerate that work to hours, Reuters reported.
Experts differed on what more discoveries mean for attackers. Daniel Stenberg, lead developer of curl, said bugs identified by AI can be unusual and difficult to exploit. Ramy Rahman, a senior principal solutions engineer at ArmorCode, cautioned that more public disclosures alone do not show that attackers are succeeding more often.
Matthew Prince, Cloudflare’s chief executive, told Reuters he knows of additional serious weaknesses in critical software and expects “busy months ahead.” He said clearing long-hidden flaws could ultimately benefit the industry despite near-term disruptions. VulnCheck’s research, expected in the coming days, is the next near-term update on the pace of discoveries, Reuters reported.
