Artificial intelligence is uncovering a growing wave of software vulnerabilities that could trigger further internet disruptions, according to seven cybersecurity professionals following outages affecting government websites across Europe and elsewhere this week.
Research from Massachusetts-based threat intelligence firm VulnCheck, due to be published in the coming days, indicates that the number of digital vulnerabilities discovered has doubled year-on-year, highlighting the growing scale of the challenge facing security teams.
Matthew Prince, chief executive of digital infrastructure company Cloudflare, that he was aware of numerous additional severe vulnerabilities in other critical software systems. He warned that AI was exposing long-hidden weaknesses across the internet’s underlying infrastructure.
“I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,” Prince said in an interview on Thursday.
PHP Vulnerability Triggers Global Security Scramble
The recent disruptions began after weaknesses were discovered in PHP, a long-established programming language used to power a substantial portion of the internet.
Block Introduces Dessa, an AI Model That Learns to Speak by Listening
Website operators rushed to secure their systems amid concerns that hackers could exploit the vulnerabilities before patches were installed. Some organisations reportedly took websites offline temporarily because they feared they would not be able to apply security fixes in time.
Patrick Garrity, a researcher at VulnCheck, said the PHP response came during an already unusually busy week for cybersecurity professionals.
Other developments included vulnerability disclosures involving Node.js, an alternative to PHP in some applications, and Plex, a media-streaming platform. Security breaches were also linked to LiteLLM, an AI gateway, and Railway, a software development platform.
Additionally, researchers revealed that Indian certificate authority eMudhra had used an exceptionally weak cryptographic key, potentially exposing internet users to security risks.
“If we just saw four or five things like this, this week, I would expect we’re going to see a lot more,” Garrity said. “I think there’s going to be a lot more fire drills for anything that’s internet exposed.”
AI Is Compressing the Timeline for Cyberattacks
Modern software systems contain enormous and interconnected codebases, making programming errors difficult to identify. Some of these errors create vulnerabilities that attackers can exploit to gain unauthorised access or compromise systems.
Traditionally, identifying a vulnerability required specialist expertise, while developing a working exploit could take experienced professionals weeks or months. That delay often gave security teams time to investigate problems, release patches and update affected systems.
Artificial intelligence is changing that balance.
AI models can examine large codebases continuously, identify multiple weaknesses and potentially help develop exploits within hours. This reduces the time available for organisations to respond before attackers attempt to weaponise newly discovered flaws.
Shane Fry, chief technology officer at Virginia-based RunSafe Security, said recent advances had demonstrated that AI was changing the cybersecurity landscape.
“What’s fundamentally, and unquestionably, changing is the timescale for not only finding vulnerabilities, but how quickly adversaries can weaponize them,” Fry said.
The shift creates challenges for organisations responsible for maintaining internet-facing services, particularly when vulnerabilities affect widely used software or infrastructure.
Experts Debate Whether AI Will Fuel More Successful Attacks
Although cybersecurity professionals broadly agree that response times are shrinking, they differ on whether AI-driven discoveries will inevitably result in a surge of successful cyberattacks.
Daniel Stenberg, lead developer of the file-transfer tool curl, argued that vulnerabilities identified by AI models can involve unusual or complicated flaws that are difficult for malicious actors to exploit.
Ramy Rahman, a senior principal solutions engineer at cybersecurity company ArmorCode, also cautioned against equating the growing number of disclosed vulnerabilities with an automatic increase in successful attacks.
“More disclosed vulnerabilities do not automatically mean more successful attacks,” Rahman said.
The response to the recent PHP vulnerability offered some tentative evidence that discovering a weakness does not necessarily translate into an immediate, successful exploit.
Threat intelligence firm Hunt.io reported aggressive attempts to take advantage of the flaw, similar to activity observed by Amazon and Cloudflare. However, the firm’s head of research, Esteban Borges, said that as of 2 p.m. Eastern Time on Thursday, the cybercriminals he was tracking appeared to have failed to develop a working exploitation tool.
Prince, meanwhile, he had seen anecdotal evidence of compromises linked to the PHP vulnerability, underscoring the uncertainty surrounding the scale of the threat.
AI Could Ultimately Strengthen Internet Security
Despite the immediate risks, Prince argued that the growing number of AI-assisted vulnerability discoveries could produce long-term benefits by forcing organisations to identify and repair weaknesses that might otherwise remain hidden.
He compared the process to confronting monsters in a haunted house, suggesting that although the experience could be frightening, leaving dangerous weaknesses undiscovered would be worse.
“The reality is, we’re going to get a lot of this stuff cleaned up,” he said.
The immediate challenge for cybersecurity teams is to adapt to a landscape in which vulnerabilities can be discovered and potentially exploited much faster than traditional security processes were designed to handle.
As AI tools become more capable, organisations may need to accelerate vulnerability assessment, patch deployment and monitoring to reduce the window in which attackers can take advantage of newly exposed flaws.
