Cybersecurity experts warn that artificial intelligence is dramatically shortening vulnerability discovery and exploitation timelines, forcing developers and infrastructure providers to rethink how quickly they secure critical systems.
Artificial intelligence is exposing software vulnerabilities faster than many organizations can repair them, turning cybersecurity discoveries into potential service disruptions. A global scramble to patch flaws in PHP this week illustrates how the technology strengthening security research is also compressing the time available to protect critical infrastructure.
Seven cybersecurity professionals interviewed by Reuters on October 23 warned that additional AI-assisted discoveries could bring repeated security emergencies.
Massachusetts-based threat intelligence firm VulnCheck has forthcoming research indicating that the number of discovered digital vulnerabilities has doubled year-on-year, partly driven by AI.
PHP Vulnerabilities Trigger Global Security Scramble
Government websites across Europe and elsewhere experienced interruptions beginning October 21 after vulnerabilities were identified in PHP, a programming language widely used in web development.
According to The Straits Times, some website operators temporarily disconnected their services rather than risk exploitation before installing security updates.
The Associated Press reported that PHP supports approximately 70% of websites worldwide, although that does not mean every PHP-based website was vulnerable.
Cloudflare CEO Matthew Prince told Reuters that additional severe vulnerabilities were being addressed in critical software, warning of an extended period of cybersecurity emergencies.
The PHP incident followed other security developments involving Node.js, streaming platform Plex, AI gateway LiteLLM and development platform Railway.
VulnCheck researcher Patrick Garrity also highlighted concerns about a weak cryptographic key used by Indian certificate authority eMudhra, which potentially exposed internet users to additional security risks.
AI Is Shrinking the Window Between Discovery and Attack
Traditionally, identifying vulnerabilities and developing working exploits could require weeks or months of specialized work.
Now, AI-powered vulnerability discovery allows models to inspect extensive codebases continuously and potentially produce exploits within hours.
Shane Fry, chief technology officer at RunSafe Security, emphasized that AI is changing both the speed of discovering vulnerabilities and the time attackers need to weaponize them.
For engineering teams, this acceleration increases pressure to identify vulnerable dependencies, deploy security patches and protect internet-facing systems before attackers exploit newly disclosed weaknesses.
More Vulnerabilities Do Not Necessarily Mean More Attacks
Despite growing concerns, cybersecurity experts disagree on whether AI-assisted discoveries will inevitably produce more successful cyberattacks.
Daniel Stenberg, lead developer of the curl file-transfer tool, argued that AI frequently identifies unusual vulnerabilities that attackers may struggle to exploit.
ArmorCode senior principal solutions engineer Ramy Rahman likewise cautioned that an increase in disclosed weaknesses does not automatically translate into successful intrusions.
Hunt.io head of research Esteban Borges reported that attackers monitored by the company had apparently failed to develop a working exploit for the PHP vulnerability by Thursday afternoon, despite observed exploitation attempts. Prince, however, reported anecdotal evidence of compromises.
These differing assessments highlight the distinction between discovering a security flaw, exploiting it successfully and causing widespread operational damage.
What the AI Vulnerability Surge Means for Developers
For software companies, AI-assisted vulnerability discovery introduces a difficult operational trade-off: security teams must respond faster without compromising the reliability of essential services.
Organizations increasingly need accurate software inventories, vulnerability prioritization, tested patching procedures and contingency plans for temporarily restricting exposed systems.
Although the immediate consequences may include outages and costly emergency maintenance, Prince argued that uncovering long-hidden flaws could ultimately strengthen internet security.
The broader challenge for technology builders is therefore not simply discovering more vulnerabilities. It is ensuring that defensive capabilities, infrastructure management and remediation processes evolve quickly enough to match the accelerating pace of AI-powered cybersecurity research.
