AI Accelerates Software Vulnerability Discovery, Sparking Internet Outages

Advances in artificial intelligence are accelerating the discovery of software vulnerabilities, leading to a surge in digital flaws that have begun disrupting internet-facing systems and global government websites. According to cybersecurity professionals, AI has driven a doubling of year-on-year digital flaw discoveries, a trend highlighted in upcoming research by Massachusetts-based threat intelligence firm VulnCheck.

Cloudflare CEO Matthew Prince stated that he is aware of several severe vulnerabilities present in critical software and predicted busy months ahead as AI surfaces long-hidden weaknesses in internet infrastructure. Prince noted that the industry is entering a period where frequent disruptions may become common.

Recent outages affecting government websites in Europe and other regions followed the discovery of weaknesses in PHP, a programming language widely used across the internet. Operators scrambled to fix software ahead of anticipated exploitation, with some organizations taking their sites offline temporarily to ensure safety. Patrick Garrity, a researcher at VulnCheck, noted that the PHP scramble coincided with disclosures involving alternative programming languages and platforms, including Node.js, Plex, LiteLLM, Railway, and an eMudhra cryptographic key issue.

Traditionally, finding software bugs required specialized skill, and developing functional exploits took weeks or months of work by experienced professionals. This provided defenders time to issue patches and roll out updates. However, AI models can now scan codebases around the clock, uncovering bugs and generating exploits in hours. Shane Fry, chief technology officer at RunSafe Security, stated that AI has fundamentally changed the timescale for both finding vulnerabilities and weaponizing them.

Despite the rise in disclosed vulnerabilities, industry experts remain divided on whether this will lead to widespread successful attacks. Daniel Stenberg, lead developer of curl, and Ramy Rahman, a senior principal solutions engineer at ArmorCode, suggested that AI-discovered vulnerabilities often tend to be exotic bugs that are difficult for rogue actors to exploit, emphasizing that more disclosed vulnerabilities do not automatically equate to more successful attacks.

Evidence surrounding the recent PHP vulnerability showed aggressive attempts by threat intelligence firms like Hunt.io, Amazon, and Cloudflare to observe the bug, though cybercriminals appeared to struggle in developing a working exploitation tool immediately. Prince acknowledged seeing anecdotal evidence of compromises linked to the PHP vulnerability but maintained that the wave of AI-driven discoveries is a net positive for the industry, helping clear out long-hidden security flaws.

"The rapid integration of artificial intelligence into software analysis fundamentally shifts the cybersecurity paradigm for businesses and tech startups alike. While AI drastically reduces the time required to identify code vulnerabilities, it also shortens the window for defenders to apply patches before exploits are developed. For tech enterprises and digital infrastructure providers, this means continuous, automated security monitoring and proactive vulnerability management are no longer optional. Organizations must adapt their engineering cycles to address these accelerated timelines to maintain operational resilience." — Dr. Shishir Gupta, Founder & CEO, StartupLanes