Seven cybersecurity professionals say AI cybersecurity threats are rising quickly. Weaknesses found in PHP, a widely used programming language that runs a large share of the internet, led to outages across government websites in Europe and elsewhere this week. The disruption began on Wednesday, and some site operators rushed to patch their software before attackers could exploit it, while a few took their sites offline until they could make them safe.
Why AI is shortening the time to attack
Until recently, finding a software bug and turning it into an exploit, a tool that takes advantage of the flaw, could take an experienced professional weeks or months. That gave defenders some room to fix problems and roll out updates calmly. According to the experts, AI models now scan codebases around the clock and can produce working exploits in hours. Shane Fry, chief technology officer of RunSafe Security, a Virginia-based firm, said the change is in “the timescale for not only finding vulnerabilities, but how quickly adversaries can weaponize them.”
VulnCheck, a Massachusetts-based threat intelligence firm, is due to publish research in the coming days. It says AI helped drive a doubling of the number of digital flaws discovered year-on-year. VulnCheck researcher Patrick Garrity said the PHP scramble came during a busy week that also brought disclosures of flaws in Node.js and the Plex streaming program, breaches linked to the AI gateway LiteLLM and the development platform Railway, and a weak cryptographic key used by the Indian certificate authority eMudhra. A certificate authority is a body that issues the digital certificates websites use to prove their identity.
Matthew Prince, chief executive of the internet infrastructure firm Cloudflare, said he was aware of more severe vulnerabilities in other critical software. He predicted busy months ahead and said, “I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling.”
Experts split on how far the risk will go
The experts agreed that the time defenders have is getting shorter, but they did not agree on how much harm will follow. Daniel Stenberg, lead developer of the file transfer tool curl, argued that bugs found by AI tend to be unusual and hard for criminals to use. Ramy Rahman, a senior principal solutions engineer at the cybersecurity company ArmorCode, said that more disclosed vulnerabilities do not automatically mean more successful attacks.
The PHP case offers early and mixed evidence. Hunt.io, a threat intelligence firm, said it had seen aggressive attempts to exploit the bug, as had Amazon and Cloudflare. Its head of research, Esteban Borges, said that as of 2 p.m. Eastern Time on Thursday, the cybercriminals his firm tracked appeared to have failed to build a working tool. Prince said he had seen anecdotal evidence of compromises linked to the PHP bug.
Prince compared the surge of AI-driven discoveries to clearing monsters out of a haunted house. Confronting them may be frightening, he said, but leaving them hidden behind closed doors is far worse. “The reality is, we’re going to get a lot of this stuff cleaned up,” he said. Garrity expects “a lot more fire drills” for anything exposed to the internet, which suggests that emergency patching will remain a regular task for operators.
Timeline: what has happened so far
- Wednesday: Outages begin across government websites in Europe and elsewhere after weaknesses in PHP are discovered.
- This week: Disclosures about Node.js, Plex, LiteLLM, Railway and the eMudhra key add to a busy week for cybersecurity.
- Thursday: Prince tells interviewers he expects a run of severe vulnerabilities and says he has seen anecdotal evidence of compromises linked to PHP.
- Thursday, 2 p.m. Eastern Time: Hunt.io says the criminals it tracked appeared not to have built a working tool to exploit the PHP bug.
Aasan alfaaz mein
AI se software ki kamzoriyan pehle se zyada jaldi mil rahi hain, aur PHP mein kharabi ke baad kai sarkari websites kuch dair ke liye band hui hain. Experts kehte hain ke aisi kharabiyan aur bhi ho sakti hain, magar har hamla kamyab hona zaroori nahi. Aam user ke liye matlab yeh hai ke apne phone, apps aur online accounts ko update rakhein aur mazboot passwords istemal karein.
