AI-discovered bugs may soon trigger fresh disruptions, cyber experts say - Reuters

Summary Companies Cloudflare CEO says 'a bunch of additional severe vulnerabilities' are currently being patched One cybersecurity expert said that, following PHP disclosures, 'there’s going to be a lot more fire drills' Experts split on whether more AI-found vulnerabilities will translate into more successful hacks WASHINGTON, Oct 23 (Reuters) - Advances in artificial intelligence have uncovered a stream of new software vulnerabilities that are almost ​certain to trigger more disruption along the lines of the outages that percolated across global government websites this week, according to seven cybersecurity professionals who spoke to ‌Reuters. AI helped drive a doubling of the number of digital flaws discovered year-on-year, according to research due to be published in the coming days by VulnCheck, a Massachusetts-based threat intelligence firm. Sign up here. Matthew Prince, the chief executive of the digital infrastructure firm Cloudflare (NET.N) , opens new tab , told Reuters he was aware of “a bunch of additional severe vulnerabilities that are present in other pieces of critical software” and predicted busy months ahead as AI surfaced long-hidden weaknesses in the ​fabric of the internet. “I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,” Prince said in an ​interview on Thursday. The outages that spread across government sites in Europe and elsewhere beginning on Wednesday happened after the discovery of weaknesses in PHP, ⁠a venerable programming language that powers a huge swath of the internet. Operators have been rushing to fix their software in anticipation of mass exploitation and, because some felt they could ​not patch before hackers jumped in, a subset simply yanked their sites offline until they could make them safe. VulnCheck researcher Patrick Garrity said the scramble to fix PHP came during an already busy ​week in cybersecurity. The week also brought disclosures of vulnerabilities PHP alternative Node.js and streaming program Plex, breaches tied to AI gateway LiteLLM and development platform Railway, and the revelation that the Indian certificate authority eMudhra had used an extraordinarily flimsy cryptographic key that potentially put users across the internet at risk. “If we just saw four or five things like this, this week, I would expect we’re going to see a lot more,” Garrity said. “I ​think there’s going to be a lot more fire drills for anything that’s internet exposed.” TIMELINES SHORTENING The codebases that run modern programs are sprawling and mistakes, or “bugs,” that open up potential avenues ​for exploitation often crop up in unexpected places. Previously, finding bugs required a baseline level of skill, and taking advantage of those bugs to build digital lockpicks – called “exploits” – could be expected to take weeks or months ‌of work ⁠by an experienced professional. Computer code is displayed on multiple screens in this illustration taken on October 22, 2026. REUTERS/Dado Ruvic/Illustration Purchase Licensing Rights , opens new tab That would in the past have provided defenders a little breathing room to fix bugs and gently roll out software updates. AI has effectively thrown those assumptions out the window . Models can find one bug after another by subjecting codebases to round-the-clock scrutiny, and can turn around exploits in hours. Shane Fry, the chief technology officer of Virginia-based RunSafe Security, said the demonstrated performance of AI models over the past few months had effectively laid to rest any doubts over whether they would change the industry. “What's fundamentally, and unquestionably, changing is the timescale for not only finding ​vulnerabilities, but how quickly adversaries can weaponize ​them,” Fry said. SCARY MONSTERS While all the experts ⁠Reuters spoke to agreed that defenders’ timelines were getting shorter, they were split on whether AI would lead to a hacker free-for-all. Daniel Stenberg, the lead developer of the file transfer tool curl, argued the vulnerabilities found by AI models tended to be exotic bugs that were difficult for ​rogue actors to take advantage of. Ramy Rahman, a senior principal solutions engineer at cybersecurity company ArmorCode, said “more disclosed vulnerabilities do not ​automatically mean more successful attacks." There ⁠was tentative evidence of that around the PHP vulnerability that drew worldwide concern this week. Threat intelligence firm Hunt.io said that – like Amazon , opens new tab (AMZN.O) , opens new tab and Cloudflare – it had seen aggressive attempts to take advantage of the bug. But the firm’s head of research, Esteban Borges, said that, as of 2 p.m. Eastern Time on Thursday (1800 GMT), the cybercriminals he tracked appeared to have failed , opens new tab to cobble together a working tool ⁠to take ​advantage of it. Prince, of Cloudflare, told Reuters he had seen anecdotal evidence of compromises linked to the PHP vulnerability. The ​deluge of AI-driven discoveries might rattle the industry, but would be a net positive in the end, he said, comparing it to slaying the monsters in a haunted house. The confrontation might be scary, he said, but leaving the monsters to lurk ​quietly behind closed doors was far worse. “The reality is, we’re going to get a lot of this stuff cleaned up,” he said. Reporting by Raphael Satter and AJ Vicens; editing by Lincoln Feast. Our Standards: The Thomson Reuters Trust Principles. , opens new tab X Facebook Linkedin Email Link Purchase Licensing Rights Raphael Satter Thomson Reuters Reporter covering cybersecurity, surveillance, and disinformation for Reuters. Work has included investigations into state-sponsored espionage, deepfake-driven propaganda, and mercenary hacking. Email X Instagram Linkedin A.J. Vicens Thomson Reuters Cybersecurity correspondent covering cybercrime, nation-state threats, hacks, leaks and intelligence Email Read Next / Editor's Picks ago Retail & Consumer category Apple's foldable iPhone hits stores with $2,000 price tag and scarce supply ago Retail & Consumer category EXCLUSIVE Fast-fashion group Shein agrees to pay $100 million to settle US FTC probe ago Retail & Consumer category Amazon cloud capacity sold out through 2027, CEO Jassy says ago Retail & Consumer category LVHM-owned watchmaker Zenith to cut jobs, shift upmarket, source says ago Legal category EXCLUSIVE Heineken document reveals worries over weight-loss drugs and beer sales ago Retail & Consumer category Gucci owner Kering drops 16% as luxury braces for tough winter ago Retail & Consumer category L'Oreal shares bounce on third-quarter sales October 22, 2026 Retail & Consumer category P&G warns of bigger cost hit from oil prices, even as consumer demand holds up October 22, 2026 Retail & Consumer category As Americans eat out less, paper towel maker Essity feels the pinch ago Retail & Consumer category Hugo Boss set to become Frasers subsidiary as stake crosses 50% ago Retail & Consumer category 'Truly something cool': Apple fans react as iPhone Duo hits stores ago Retail & Consumer category French malt producer Malteurop acquires Chunlei to expand Chinese capacity ago Take Five category Take Five: AI trade meets the Fed ago Retail & Consumer category UK's Debenhams returns to profit after five years, expects further cost cuts October 22, 2026 Retail & Consumer category Gucci sales slip again in latest blow to Kering recovery plan