AI-discovered bugs may soon trigger fresh disruptions, cyber experts say

WASHINGTON – Advances in artificial intelligence have uncovered a stream of new software vulnerabilities that are almost certain to trigger more disruption along the lines of the outages that percolated across global government websites this week, cybersecurity professionals have warned.AI helped drive a doubling of the number of digital flaws discovered year-on-year, according to research due to be published in the coming days by VulnCheck, a Massachusetts-based threat intelligence firm.Matthew Prince, chief executive of digital infrastructure firm Cloudflare, said he is aware of “a bunch of additional severe vulnerabilities that are present in other pieces of critical software”, and predicted busy months ahead as AI surfaces long-hidden weaknesses in the fabric of the internet.“I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,” Prince said.The outages that spread across government sites in Europe and elsewhere beginning on Oct 21 happened after the discovery of weaknesses in PHP, a venerable programming language that powers a huge swathe of the internet.Operators have been rushing to fix their software in anticipation of mass exploitation and, because some felt they could not patch before hackers jumped in, a subset simply yanked their sites offline until they could make them safe.VulnCheck researcher Patrick Garrity said the scramble to fix PHP came during an already busy week in cybersecurity.The week also brought disclosures of vulnerabilities PHP alternative Node.js and streaming program Plex, breaches tied to AI gateway LiteLLM and development platform Railway, and the revelation that the Indian certificate authority eMudhra used an extraordinarily flimsy cryptographic key that potentially put users across the internet at risk.“If we just saw four or five things like this, this week, I would expect we’re going to see a lot more,” Garrity said. “I think there’s going to be a lot more fire drills for anything that’s internet exposed.”Timelines shorteningThe codebases that run modern programs are sprawling and mistakes, or “bugs”, that open up potential avenues for exploitation often crop up in unexpected places.Previously, finding bugs required a baseline level of skill, and taking advantage of those bugs to build digital lockpicks – called “exploits” – could be expected to take weeks or months of work by an experienced professional.That would, in the past, have provided defenders a little breathing room to fix bugs and gently roll out software updates.AI has effectively thrown those assumptions out the window. Models can find one bug after another by subjecting codebases to round-the-clock scrutiny, and can turn around exploits in hours.Shane Fry, chief technology officer of Virginia-based RunSafe Security, said the demonstrated performance of AI models over the past few months has effectively laid to rest any doubts over whether they would change the industry.“What’s fundamentally, and unquestionably, changing is the timescale for not only finding vulnerabilities, but how quickly adversaries can weaponise them,” Fry said.Scary monstersWhile all the experts agree that defenders’ timelines are getting shorter, they are split on whether AI will lead to a hacker free-for-all.Daniel Stenberg, lead developer of file transfer tool curl, argued the vulnerabilities found by AI models tend to be exotic bugs that are difficult for rogue actors to take advantage of.Ramy Rahman, a senior principal solutions engineer at cybersecurity company ArmorCode, said “more disclosed vulnerabilities do not automatically mean more successful attacks”.There was tentative evidence of that around the PHP vulnerability that drew worldwide concern this week.Threat intelligence firm Hunt.io said that – like Amazon and Cloudflare – it has seen aggressive attempts to take advantage of the bug. But the firm’s head of research, Esteban Borges, said cybercriminals he tracked appear to have failed to cobble together a working tool to take advantage of it.Prince, of Cloudflare, said he has seen anecdotal evidence of compromises linked to the PHP vulnerability.The deluge of AI-driven discoveries might rattle the industry, but would be a net positive in the end, he said, comparing it to slaying the monsters in a haunted house.The confrontation may be scary, he said, but leaving the monsters to lurk quietly behind closed doors is far worse.“The reality is, we’re going to get a lot of this stuff cleaned up,” he said. REUTERS