Artificial intelligence is uncovering software vulnerabilities at an unprecedented pace, and the cybersecurity industry is facing a structural shock. Multiple industry experts warn that in the coming months, large-scale outages similar to the one that swept government websites worldwide this week will occur one after another.
This week, the programming language PHP was found to have a serious security flaw, causing government websites across Europe and other regions to suffer service disruptions. Some operators, unable to complete fixes before hackers could exploit the flaw, were forced to take their websites offline entirely. Cloudflare CEO Matthew Prince told Reuters that he is aware of "a large number of additional critical vulnerabilities" in other key software that are currently being patched, and predicted a turbulent period lasting several years in which "every week it will feel like the sky is falling."
According to Reuters, seven cybersecurity professionals unanimously agree that the AI-driven wave of vulnerability discovery will almost certainly trigger more large-scale disruptions like this week's. Research soon to be released by Massachusetts-based threat intelligence firm VulnCheck shows that the involvement of AI has driven the number of digital vulnerabilities discovered this year to double year-over-year.
Vulnerability Discovery Accelerates, Drastically Compressing the Defensive Window
In the past, discovering software vulnerabilities required considerable technical expertise, and turning a vulnerability into a practically usable attack tool—known as an "exploit"—often took experienced professionals weeks or even months. This time gap once provided defenders with a relatively ample window for remediation.
The emergence of AI has fundamentally broken this logic. AI models can scan codebases around the clock, continuously discovering vulnerabilities, and can complete the construction of attack tools within hours. Shane Fry, Chief Technology Officer of Virginia-based RunSafe Security, said that the actual performance of AI models in recent months has completely dispelled industry doubts about whether they can change the industry landscape.
"What is fundamentally and undeniably changing is the speed at which vulnerabilities are discovered, and the speed at which attackers weaponize them," Fry said.
VulnCheck researcher Patrick Garrity pointed out that the emergency response to the PHP vulnerability occurred within an already busy week. Security incidents exposed during the same period also included: vulnerability disclosures in the PHP alternative language Node.js and the streaming application Plex, data breaches at AI gateway LiteLLM and development platform Railway, and the discovery that Indian certificate authority eMudhra was using extremely weak encryption keys, putting internet users worldwide at potential risk.
"If four or five such things happened in a single week, I expect we will see more in the future," Garrity said. "Any system exposed to the internet will face more emergency drills."
Will the Surge in Vulnerabilities Necessarily Lead to Higher Attack Success Rates? Experts Are Divided
Although the experts interviewed generally agree that defenders' response times are shrinking, opinions differ on whether AI will trigger a full-scale outbreak of hacker attacks.
Daniel Stenberg, lead developer of the file transfer tool curl, believes that vulnerabilities discovered by AI models tend to be relatively rare "exotic vulnerabilities" that malicious actors find difficult to exploit directly. Ramy Rahman, Senior Director Solutions Engineer at cybersecurity company ArmorCode, also said that "more disclosed vulnerabilities do not automatically mean more successful attacks."
This week's PHP vulnerability incident provides some supporting evidence. According to Reuters, threat intelligence firm Hunt.io said that, like Amazon and Cloudflare, it has also observed large-scale exploitation attempts targeting the vulnerability. However, Esteban Borges, head of research at Hunt.io, said that as of 2 p.m. Eastern Time on Thursday, the cybercriminals he was tracking did not appear to have successfully assembled a working attack tool.
Cloudflare's Matthew Prince told Reuters that he has seen scattered intrusion cases related to the PHP vulnerability.
Industry Pain May Yield Long-Term Security Dividends
Although the AI-driven wave of vulnerability discovery is putting pressure on the industry, some experts believe that this process is a net positive for the overall security ecosystem in the long run.
Matthew Prince compared it to "slaying monsters in a haunted house": rather than letting hidden dangers lurk in the dark for a long time, it is better to confront them head-on. "The reality is that we are going to clean up a lot of this," he said.
For investors, this trend means that demand in the cybersecurity sector will continue to expand. Digital infrastructure companies such as Cloudflare, as well as security vendors focused on vulnerability management and threat intelligence, are expected to continue benefiting from this AI-driven security arms race. At the same time, enterprises of all kinds will face rising spending pressure on security compliance and emergency response.
Comments