AI-Driven Vulnerability Discoveries Raise Cybersecurity Concerns Worldwide

Artificial intelligence (AI) is uncovering software vulnerabilities at an accelerating pace, raising concerns about future cyberattacks and internet disruptions. Seven cybersecurity professionals told Reuters that the trend could trigger more outages similar to those affecting government websites worldwide this week.

Research from Massachusetts-based threat intelligence firm VulnCheck, due for publication in the coming days, indicates that the number of discovered digital vulnerabilities has doubled year on year, with AI contributing to the increase.

Matthew Prince, chief executive of digital infrastructure company Cloudflare, warned that the industry faces a period of intense cybersecurity activity. He said he was aware of several additional severe vulnerabilities affecting critical software.

“I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,” Prince told Reuters on Thursday.

PHP Vulnerabilities Trigger Global Disruption

Recent disruptions affecting government websites in Europe and other regions followed the discovery of security weaknesses in PHP, a programming language used widely across the internet.

Website operators rushed to patch affected systems amid fears that attackers could exploit the vulnerabilities. Some organisations temporarily took their websites offline because they could not guarantee their systems would remain secure before attackers struck.

UK Announces £600 Million AI Security and Biosecurity Funding Package

Patrick Garrity, a researcher at VulnCheck, said the PHP incident occurred during an unusually busy week for cybersecurity.

Security researchers also disclosed vulnerabilities affecting Node.js, an alternative to PHP for certain applications, and Plex, a media-streaming platform. Meanwhile, breaches involving AI gateway LiteLLM and development platform Railway added to the concerns.

Another incident involved Indian certificate authority eMudhra, which reportedly used a weak cryptographic key that potentially exposed internet users to security risks.

Garrity expects more urgent responses from organisations operating internet-facing systems.

“If we just saw four or five things like this, this week, I would expect we’re going to see a lot more,” he said.

AI Shortens the Window for Cyber Defence

Traditionally, identifying software vulnerabilities required specialised skills and considerable time. Developing an exploit to take advantage of a flaw could take experienced professionals weeks or months.

That delay gave security teams time to investigate weaknesses, prepare patches and deploy software updates.

AI is changing this timeline. Advanced models can analyse large codebases continuously, identify multiple vulnerabilities and help develop exploits in a matter of hours.

Shane Fry, chief technology officer at Virginia-based RunSafe Security, said recent AI advances had demonstrated their potential to transform cybersecurity.

“What’s fundamentally, and unquestionably, changing is the timescale for not only finding vulnerabilities, but how quickly adversaries can weaponise them,” Fry said.

As a result, organisations may have less time to secure their systems after researchers disclose a vulnerability. Security teams could face growing pressure to identify affected software, prioritise urgent fixes and deploy updates before attackers exploit known weaknesses.

Experts Differ on the Risk of More Successful Attacks

Although cybersecurity professionals broadly agree that AI is accelerating vulnerability discovery, they disagree on whether the trend will inevitably lead to more successful cyberattacks.

Daniel Stenberg, lead developer of the file-transfer tool curl, argued that AI-discovered vulnerabilities can involve complex technical weaknesses that criminals may struggle to exploit.

Similarly, Ramy Rahman, a senior principal solutions engineer at cybersecurity company ArmorCode, cautioned against equating a higher number of disclosed vulnerabilities with a rise in successful attacks.

“More disclosed vulnerabilities do not automatically mean more successful attacks,” Rahman said.

The recent PHP incident offered an early example of this distinction. Threat intelligence firm Hunt.io reported aggressive attempts to exploit the vulnerability. However, its head of research, Esteban Borges, said that by 2 p.m. Eastern Time on Thursday, the cybercriminals he was tracking had not assembled a working exploit.

Prince, however, told Reuters that he had seen anecdotal evidence of compromises linked to the PHP vulnerability.

AI Could Ultimately Strengthen Cybersecurity

Despite the immediate risks, some experts believe AI-driven vulnerability discovery could improve security over time.

Prince argued that uncovering long-hidden flaws could help organisations remove weaknesses that might otherwise remain undetected for years. He compared the process to confronting and eliminating monsters hidden inside a haunted house.

Although the transition could be unsettling, he suggested that leaving vulnerabilities undiscovered would pose a greater long-term danger.

“The reality is, we’re going to get a lot of this stuff cleaned up,” he said.

The challenge for organisations will be to match the speed of AI-assisted vulnerability discovery with faster patching, continuous monitoring and stronger incident response. As AI tools become more capable, both defenders and attackers are likely to face a rapidly changing cybersecurity landscape.