\n<\/p>\n
Advances in artificial intelligence have uncovered a stream of new software vulnerabilities that are almost \u200bcertain to trigger more disruption along the lines of the outages that percolated across global government websites this week, according to seven cybersecurity professionals who spoke to \u200cReuters.<\/strong><\/p>\n AI helped drive a doubling of the number of digital flaws discovered year-on-year, according to research due to be published in the coming days by VulnCheck, a Massachusetts-based threat intelligence firm.<\/p>\n Matthew Prince, the chief executive of the digital infrastructure firm Cloudflare, told Reuters he was aware of \u201ca bunch of additional severe vulnerabilities that are present in other pieces of critical software\u201d and predicted busy months ahead as AI surfaced long-hidden weaknesses in the \u200bfabric of the internet.<\/p>\n \u201cI think we\u2019re going to have a couple years where every single week it\u2019s going to feel like the sky is falling,\u201d Prince said in an \u200binterview on Thursday.<\/p>\n The outages that spread across government sites in Europe and elsewhere beginning on Wednesday happened after the discovery of weaknesses in PHP, \u2060a venerable programming language that powers a huge swath of the internet. Operators have been rushing to fix their software in anticipation of mass exploitation and, because some felt they could \u200bnot patch before hackers jumped in, a subset simply yanked their sites offline until they could make them safe.<\/p>\n VulnCheck researcher Patrick Garrity said the scramble to fix PHP came during an already busy \u200bweek in cybersecurity. The week also brought disclosures of vulnerabilities PHP alternative Node.js and streaming program Plex, breaches tied to AI gateway LiteLLM and development platform Railway, and the revelation that the Indian certificate authority eMudhra had used an extraordinarily flimsy cryptographic key that potentially put users across the internet at risk.<\/p>\n \u201cIf we just saw four or five things like this, this week, I would expect we\u2019re going to see a lot more,\u201d Garrity said. \u201cI \u200bthink there\u2019s going to be a lot more fire drills for anything that\u2019s internet exposed.\u201d<\/p>\n TIMELINES SHORTENING<\/strong><\/p>\n The codebases that run modern programs are sprawling and mistakes, or \u201cbugs,\u201d that open up potential avenues \u200bfor exploitation often crop up in unexpected places.<\/p>\n Previously, finding bugs required a baseline level of skill, and taking advantage of those bugs to build digital lockpicks \u2013 called \u201cexploits\u201d \u2013 could be expected to take weeks or months \u200cof work \u2060by an experienced professional.<\/p>\n That would in the past have provided defenders a little breathing room to fix bugs and gently roll out software updates.<\/p>\n AI has effectively thrown those assumptions out the window. Models can find one bug after another by subjecting codebases to round-the-clock scrutiny, and can turn around exploits in hours. Shane Fry, the chief technology officer of Virginia-based RunSafe Security, said the demonstrated performance of AI models over the past few months had effectively laid to rest any doubts over whether they would change the industry.<\/p>\n \u201cWhat\u2019s fundamentally, and unquestionably, changing is the timescale for not only finding \u200bvulnerabilities, but how quickly adversaries can weaponize \u200bthem,\u201d Fry said.<\/p>\n SCARY MONSTERS<\/strong><\/p>\n While all the experts \u2060Reuters spoke to agreed that defenders\u2019 timelines were getting shorter, they were split on whether AI would lead to a hacker free-for-all.<\/p>\n Daniel Stenberg, the lead developer of the file transfer tool curl, argued the vulnerabilities found by AI models tended to be exotic bugs that were difficult for \u200brogue actors to take advantage of. Ramy Rahman, a senior principal solutions engineer at cybersecurity company ArmorCode, said \u201cmore disclosed vulnerabilities do not \u200bautomatically mean more successful attacks.\u201d<\/p>\n There \u2060was tentative evidence of that around the PHP vulnerability that drew worldwide concern this week. Threat intelligence firm Hunt.io said that \u2013 like Amazon, and Cloudflare \u2013 it had seen aggressive attempts to take advantage of the bug. But the firm\u2019s head of research, Esteban Borges, said that, as of 2 p.m. Eastern Time on Thursday (1800 GMT), the cybercriminals he tracked appeared to have failed, to cobble together a working tool \u2060to take \u200badvantage of it.<\/p>\n Prince, of Cloudflare, told Reuters he had seen anecdotal evidence of compromises linked to the PHP vulnerability.<\/p>\n The \u200bdeluge of AI-driven discoveries might rattle the industry, but would be a net positive in the end, he said, comparing it to slaying the monsters in a haunted house.<\/p>\n The confrontation might be scary, he said, but leaving the monsters to lurk \u200bquietly behind closed doors was far worse.<\/p>\n \u201cThe reality is, we\u2019re going to get a lot of this stuff cleaned up,\u201d he said.<\/p>\n<\/div>\n