AI Is Doubling Software Bug Discoveries, Cyber Experts Warn of More Disruptions

🤖 Advances in artificial intelligence have uncovered a stream of new software vulnerabilities that are almost certain to trigger more disruption along the lines of the outages that percolated across global government websites this week, according to seven cybersecurity professionals who spoke to Reuters. AI helped drive a doubling of the number of digital flaws discovered year on year, according to research due to be published in the coming days by VulnCheck, a Massachusetts-based threat intelligence firm — a pace that is rewriting the industry's assumptions about how long defenders have to act.

☁ Matthew Prince, chief executive of the digital infrastructure firm Cloudflare, told Reuters he was aware of a bunch of additional severe vulnerabilities present in other pieces of critical software, and predicted busy months ahead as AI surfaces long-hidden weaknesses in the fabric of the internet. I think we're going to have a couple of years where every single week it's going to feel like the sky is falling, Prince said in an interview on Thursday.

🚧 The outages that spread across government sites in Europe and elsewhere beginning on Wednesday followed the discovery of weaknesses in PHP, a venerable programming language that powers a huge swathe of the internet. Operators rushed to fix their software in anticipation of mass exploitation — and because some felt they could not patch before hackers jumped in, a subset simply took their sites offline until they could make them safe, an extraordinary precaution that emptied digital front desks from Tokyo to Helsinki.

🔥 VulnCheck researcher Patrick Garrity said the scramble to fix PHP came during an already busy week in cybersecurity: the week also brought disclosures of vulnerabilities in the PHP alternative Node.js and the streaming programme Plex, breaches tied to the AI gateway LiteLLM and the development platform Railway, and the revelation that the Indian certificate authority eMudhra had used an extraordinarily flimsy cryptographic key that potentially put users across the internet at risk. If we just saw four or five things like this in one week, I would expect we're going to see a lot more, Garrity said. I think there's going to be a lot more fire drills for anything that's internet exposed.

⏱ The collapse of the defenders' timeline

🧱 The codebases that run modern programmes are sprawling, and the mistakes that open potential avenues for exploitation often crop up in unexpected places. Previously, finding bugs required a baseline level of skill, and turning those bugs into digital lockpicks — exploits — could be expected to take weeks or months of work by an experienced professional. That delay gave defenders breathing room to fix flaws and gently roll out software updates before adversaries could act.

💥 AI has effectively thrown those assumptions out of the window. Models can find one bug after another by subjecting codebases to round-the-clock scrutiny, and can turn around exploits in hours. Shane Fry, chief technology officer of Virginia-based RunSafe Security, said the demonstrated performance of AI models over the past few months had laid to rest any doubts over whether they would change the industry. What's fundamentally, and unquestionably, changing is the timescale for not only finding vulnerabilities, but how quickly adversaries can weaponise them, Fry said.

⚖ Does the flood mean a hacker free-for-all?

🧪 While all the experts Reuters spoke to agreed that defenders' timelines were getting shorter, they were split on whether AI would lead to a hacker free-for-all. Daniel Stenberg, lead developer of the widely used file transfer tool curl, argued that the vulnerabilities found by AI models tended to be exotic bugs that were difficult for rogue actors to take advantage of. Ramy Rahman, a senior principal solutions engineer at cybersecurity company ArmorCode, said more disclosed vulnerabilities do not automatically mean more successful attacks.

🔍 There was tentative evidence of that around the PHP vulnerability that drew worldwide concern this week. Threat intelligence firm Hunt.io said that, like Amazon and Cloudflare, it had seen aggressive attempts to take advantage of the bug — but its head of research, Esteban Borges, said that as of 2pm Eastern Time on Thursday, the cybercriminals he tracked appeared to have failed to cobble together a working tool to exploit it. Prince, however, told Reuters he had seen anecdotal evidence of compromises linked to the PHP vulnerability, keeping the risk assessment honest on both sides.

👽 The deluge of AI-driven discoveries might rattle the industry but would be a net positive in the end, Prince argued, comparing it to slaying the monsters in a haunted house: the confrontation might be scary, but leaving the monsters to lurk quietly behind closed doors was far worse. The reality is, we're going to get a lot of this stuff cleaned up, he said — a long-overdue audit of the internet's ageing foundations, conducted at machine speed.

🌏 What it means for Bangladesh's digital economy

💻 For Bangladesh — a country where the same PHP outage forced Bangladesh Bank to take its website offline as a precaution — the message is particularly pointed. The country's banks, government portals, e-commerce platforms and the fast-growing software export industry all run on the same global software stack whose hidden flaws AI is now exposing one by one. That cuts both ways: Bangladeshi firms inherit the risk of faster weaponisation, but they also gain access to the same AI-assisted scanning and patching tools that are raising the global baseline.

🚀 The strategic response is well understood by now: inventories of every system and library in use, automated vulnerability scanning as a routine rather than a fire drill, security operations centres that can act in hours, and procurement rules that treat patchability as a product feature. Firms building for export markets — from fintech to business process services — can even turn hygiene into a commercial asset: demonstrable security practice is increasingly part of due diligence in international contracts.

🔭 The industry's split verdict — more bugs found, but not necessarily more breaches — suggests the outcome depends less on the technology than on the response. The institutions that treat the coming years of sky-is-falling headlines as a forcing function for discipline will emerge with cleaner, more defensible systems; those that treat each warning as noise will keep discovering that their emergency procedures were never rehearsed. AI has made software insecurity louder; what organisations do about the noise is still, entirely, up to them.