AI Accelerates Vulnerability Discovery, Shrinking Defense Windows

Research set to be released by VulnCheck, a US-based cyber threat intelligence firm headquartered in Massachusetts, indicates that AI has driven a surge in software vulnerability discoveries, with the number of vulnerabilities found over the past year doubling year-over-year.

Matthew Prince, CEO of digital infrastructure company Cloudflare, noted: "I know there are still many critical vulnerabilities lurking in other key software... I think for the next two years, we will feel like the sky is falling every single week."

He predicts that the cybersecurity industry will be exceptionally busy in the coming months as AI continues to uncover long-hidden security flaws in internet infrastructure.

According to IT Home, government websites across Europe and other regions experienced service disruptions this week after a security vulnerability was discovered in PHP, a legacy programming language widely used on the internet. Website operators scrambled to patch their software to prevent large-scale exploitation by hackers. Some operators, fearing they could not patch in time, chose to take their sites offline entirely until they could ensure security.

Patrick Garrity, a researcher at VulnCheck, pointed out that the emergency patching triggered by the PHP vulnerability added further strain to an already turbulent cybersecurity landscape. This week also saw vulnerabilities disclosed in Node.js (a popular alternative to PHP) and streaming software Plex, while AI gateway LiteLLM and development platform Railway were involved in security breaches.

Additionally, Indian digital certificate authority eMudhra was found to be using cryptographically weak keys, potentially endangering users worldwide. "If four or five such incidents occur in a single week, there will likely be more in the future. As long as systems are directly connected to the internet, we may need to handle security emergencies with increasing frequency," he said.

Modern software codebases are massive, and bugs often hide in unexpected places. Some of these defects are sufficient to serve as entry points for hackers to compromise systems.

In the past, discovering program vulnerabilities required specialized expertise, and transforming those vulnerabilities into functional attack tools typically took experienced technicians weeks or even months. This lengthy development process gave defenders breathing room, allowing them to use the time lag to patch vulnerabilities and roll out software updates gradually.

AI has shattered this temporal advantage. AI models can now inspect software code around the clock, identifying vulnerabilities one after another, and develop exploit programs within just hours.

Sean Fries, CTO of Virginia-based cybersecurity firm RunSafe Security, noted that over the past few months, AI models have demonstrated through actual performance that the cybersecurity industry must change. "The fundamental, indisputable shift is in time. Not only has the time required to discover vulnerabilities changed, but so has the speed at which attackers convert vulnerabilities into attack vectors."

Experts interviewed by Reuters unanimously agreed that the window for defenders to patch vulnerabilities is shrinking rapidly. However, they remain divided on whether AI will lead to a proliferation of hacker attacks.

Daniel Stenberg, the primary developer of the file transfer tool curl, believes that vulnerabilities discovered by AI models are often highly specific and difficult for malicious actors to exploit effectively.

Rami Rahman, Senior Principal Solutions Engineer at cybersecurity firm ArmorCode, also stated: "An increase in disclosed vulnerabilities does not necessarily mean a corresponding rise in successful cyberattacks."

The PHP vulnerability that drew global attention this week offers some preliminary evidence supporting this view. Threat intelligence firm Hunt.io reported that, similar to Amazon and Cloudflare, it observed intense attempts to exploit the vulnerability. However, Esteban Borges, Head of Research at Hunt.io, noted that as of 2 PM Eastern Time on Thursday, tracking data showed that cybercriminals had not yet developed effective tools capable of actually exploiting the vulnerability.

Cloudflare’s Prince mentioned seeing "glimpses" of sporadic signs that some systems had been compromised, suggesting links to the PHP vulnerability. In his view, while AI’s discovery of numerous vulnerabilities will undoubtedly shock the cybersecurity industry, the long-term benefits outweigh the drawbacks.

He likened the process to clearing monsters from a haunted house: confronting the monsters head-on is frightening, but leaving them hidden behind closed doors leads to far worse consequences. "The reality is, we will be able to eliminate a vast number of security risks."