AI vulnerability tools threaten web disruptions as bug discovery doubles

Artificial intelligence is surfacing software flaws at an unprecedented pace, threatening fresh disruptions across global digital networks as defensive timelines collapse from months to hours.

Research due from threat intelligence firm VulnCheck shows that the number of digital flaws discovered year-on-year has doubled, driven largely by automated systems examining software code around the clock.

The surge in disclosures follows disruptions across European government websites linked to vulnerabilities in PHP, the widely used programming language underpinning much of the web. System administrators were forced to take services offline to patch systems before automated exploit tools could take advantage of the weakness.

Recent software disclosures and affected systems

Shorter attack timelines

Historically, finding software bugs required specialized technical skill, and creating functional exploits took weeks or months. AI models can now scan sprawling codebases constantly, generating potential attack tools in a fraction of that time.

RunSafe Security Chief Technology Officer Shane Fry said recent model performance has changed industry timelines, noteably accelerating how quickly adversaries can turn a flaw into a working cyber weapon.

However, industry experts remain divided on whether this flood of disclosures will trigger widespread security breaches. Daniel Stenberg, lead developer of the curl file transfer tool, stated that flaws identified by AI models are frequently exotic bugs that are difficult to exploit in practice.

Similarly, solutions engineer Ramy Rahman of ArmorCode noted that an increase in disclosed flaws does not automatically translate into successful cyber attacks. Threat intelligence firm Hunt.io reported aggressive scan activity targeting the recent PHP vulnerability, though researchers had not observed a fully functional exploit tool in active use.

Cloudflare Chief Executive Matthew Prince described the rapid exposure of vulnerabilities as a net positive over the long term, arguing that exposing hidden flaws allows defenders to clean up underlying software systems permanently.