AI bug detection shortens time for cyber defenses, experts say

Artificial intelligence is leaving software operators less time to repair security weaknesses, seven cybersecurity professionals said, warning of further disruption after government websites across Europe and elsewhere went offline following discoveries of vulnerabilities in PHP.

Some operators temporarily disabled their websites because they feared hackers would exploit the flaws before repairs could be completed. PHP is a programming language widely used on the internet. Research from Massachusetts-based threat intelligence firm VulnCheck, scheduled for publication soon, says AI helped double discoveries of software vulnerabilities year-on-year.

AI systems can continuously examine code and develop tools for exploiting weaknesses within hours, work that previously could require weeks or months from experienced specialists. RunSafe Security technology chief Shane Fry said AI was changing both the pace of vulnerability detection and the speed at which attackers could exploit discoveries.

Cloudflare CEO Matthew Prince said he knew about further serious vulnerabilities in other critical software. He anticipated continuing disruption as AI exposed previously hidden flaws, while arguing that finding and fixing them would ultimately benefit the industry.

Other specialists cautioned against equating discoveries with successful intrusions. Daniel Stenberg, who leads development of the file transfer tool curl, said AI often identified unusual weaknesses that attackers would struggle to exploit. ArmorCode senior principal solutions engineer Ramy Rahman likewise said increased disclosures did not necessarily translate into more successful attacks.

Hunt.io reported aggressive efforts to exploit the PHP vulnerability. Its research head, Esteban Borges, said the criminals he followed appeared not to have built a functioning exploitation tool when he assessed their activity. Prince separately said he had anecdotal evidence of compromises involving the flaw.