AI-Discovered Software Flaws May Cause More Outages

Advances in artificial intelligence have uncovered a stream of new software vulnerabilities that are almost certain to cause more disruption like the outages that hit government websites this week, according to seven cybersecurity professionals who spoke to Reuters on October 23.

Key Points

• AI helped double the number of digital flaws found year on year, according to research due soon from threat intelligence firm VulnCheck.

• The outages followed the discovery of weaknesses in PHP, which powers a large share of the internet. Some operators took sites offline until they could patch.

• Cloudflare chief executive Matthew Prince said he knew of further severe vulnerabilities in other critical software and expected busy months ahead.

• The same week brought disclosures of flaws in Node.js and Plex, among others.

Shorter Timelines

Experts say AI models can scan codebases round the clock, find bugs one after another and turn out exploits in hours instead of the weeks or months it once took. Shane Fry of RunSafe Security said the timescale for finding and weaponising vulnerabilities is fundamentally changing.

Differing Views

Daniel Stenberg of curl said AI-found bugs tend to be exotic and hard for attackers to exploit, and ArmorCode’s Ramy Rahman said more disclosed flaws do not automatically mean more successful attacks. Hunt.io saw aggressive attempts to exploit the PHP bug but said attackers had apparently not yet built a working tool. Prince said the surge would be a net positive, comparing it to clearing out a haunted house: “we’re going to get a lot of this stuff cleaned up.”