AI Is Finding Security Flaws Faster Than the Internet Can Fix Them

Artificial intelligence is changing how software vulnerabilities are discovered. The bigger challenge is whether developers can fix them before attackers take advantage. The internet has a problem that most people never see. Behind the websites we visit, the banking apps we use, and the online services we depend on every day are millions of lines of software. Some are newly written. Others have been running for years, maintained by teams responsible for keeping them secure. Hidden inside that code are weaknesses. Some are harmless mistakes. Others can allow an attacker to steal information, disrupt a service, or take control of a computer remotely. For years, finding these weaknesses required considerable technical expertise, time, and patience. Artificial intelligence is beginning to change that equation. On October 23, 2026, Reuters reported that AI-assisted vulnerability discovery was contributing to a growing stream of newly identified software flaws. Research from cybersecurity intelligence firm VulnCheck indicated that the number of discovered digital vulnerabilities had doubled year over year, with AI identified as one contributing factor. The implications extend beyond cybersecurity teams. When vulnerabilities are discovered faster than organisations can fix them, the consequences can reach businesses, public institutions, and ordinary internet users. The emerging problem is not simply that AI can find software weaknesses. It is that discovering weaknesses and fixing them are two very different jobs. "Source: Reuters, October 23, 2026" (<a class="tc-blue" href="https://www.reuters.com/legal/litigation/ai-discovered-bugs-may-soon-trigger-fresh-disruptions-cyber-experts-say-2026-10-23/)" rel="noopener noreferrer" target="_blank">www.reuters.com/legal/litigation/ai-d... </a> The Problem Hidden Inside the Software We Use To understand why this matters, consider how a typical website works. When you visit a website, your browser communicates with a server. That server processes requests, retrieves information, and sends the appropriate response. Behind the scenes, different software components work together to make this possible. A website might depend on a content management system, a programming language, a database, external libraries, and several other services. Even if the website's owner writes excellent code, a vulnerability in one of these underlying components can put the entire service at risk. This is one reason software security is so difficult. A weakness does not necessarily belong to the organisation whose website is affected. It might exist in a programming language, a third-party library, or another component that thousands of organisations use. And if a vulnerable component is widely deployed, one security flaw can potentially expose many different systems. That is precisely why the speed at which vulnerabilities are discovered matters. AI Is Changing the Economics of Finding Vulnerabilities Traditionally, vulnerability discovery has relied heavily on security researchers examining code, testing software behaviour, and investigating unusual results. Artificial intelligence can assist with several parts of this process. Depending on the tools and the software involved, AI systems can help researchers: - Examine large codebases for suspicious patterns.- Identify potentially unsafe ways of handling data.- Suggest test cases that developers might not have considered.- Investigate how different software components interact.- Analyse errors and help researchers understand their causes.- Assist in developing proof-of-concept tests to determine whether a suspected weakness is real. These capabilities do not mean that AI automatically finds every vulnerability or that every result it produces is correct. Researchers must still validate findings, understand the affected systems, and determine whether a weakness can actually be exploited. Nevertheless, AI can reduce the amount of manual work required to investigate some classes of software defects. The consequences are significant. A vulnerability that might previously have taken considerable time to identify could become easier to discover. Security researchers could examine more software, while organisations could use similar techniques to test their own systems. But the same general capabilities could also benefit malicious actors. The technology does not inherently distinguish between someone searching for a vulnerability to fix it and someone searching for a vulnerability to exploit it. That is where the security challenge begins. A Critical PHP Security Warning Shows What Is at Stake Consider what happened this week. On October 21, the PHP development team released security updates addressing two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. The vulnerabilities could allow remote code execution without authentication on affected systems. In plain English, remote code execution means a vulnerability could enable an attacker to make a vulnerable system execute malicious instructions. The absence of an authentication requirement makes such a weakness particularly serious because the attacker may not need a legitimate account to initiate an attack. The PHP team released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The United States Cybersecurity and Infrastructure Security Agency (CISA) urged organisations to apply the updates immediately, prioritising systems exposed to the internet. On October 23, European cybersecurity authorities also updated their guidance concerning the PHP vulnerabilities. These developments illustrate how a software weakness can become an urgent operational problem. Organisations must identify affected systems, determine which software versions they use, apply the appropriate updates, and verify that their systems are protected. However, an important distinction is necessary: the PHP security advisories establish the existence and seriousness of the vulnerabilities, but they do not establish that AI discovered those particular flaws. The PHP incident is an example of the wider security pressures facing internet infrastructure, not proof that AI caused this specific incident. Sources: - "Official PHP security advisory" (<a class="tc-blue" href="https://www.php.net/archive/2026.php)" rel="noopener noreferrer" target="_blank">www.php.net/archive/2026.php) </a>- "CISA security alert" (<a class="tc-blue" href="https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42ff5ac)" rel="noopener noreferrer" target="_blank">content.govdelivery.com/accounts/USDH... </a>- "European Union Agency for Cybersecurity (ENISA)" (<a class="tc-blue" href="https://www.enisa.europa.eu/news/joint-statement-on-critical-php-vulnerabilities)" rel="noopener noreferrer" target="_blank">www.enisa.europa.eu/news/joint-statem... </a> The Race Between Discovery and Repair Finding a vulnerability does not automatically make a system vulnerable to an immediate attack. Nor does every discovered flaw become a practical weapon for cybercriminals. But the period between discovery and repair can be dangerous. Once a vulnerability becomes known, developers need to investigate it and produce a fix. Organisations must then determine whether they are affected and deploy the update. That process can take time. A company operating a small website might be able to update its software quickly. A bank, government agency, or large business could have hundreds of interconnected systems, compatibility requirements, and approval procedures to navigate. Some organisations may not even know that a vulnerable component exists within their infrastructure. Meanwhile, attackers can investigate the same vulnerability, search for exposed systems, and attempt to develop ways to exploit it. AI could intensify this race by helping researchers and attackers investigate software weaknesses more efficiently. The risk is not simply that vulnerabilities will be discovered. It is that defenders may have less time to respond before attackers can take advantage of them. This is not inevitable in every case. Some vulnerabilities are difficult to exploit, and security researchers can use AI to improve detection, testing, and remediation too. Nevertheless, organisations cannot assume that their existing response processes will remain adequate as the pace of vulnerability discovery changes. What This Means for Nigeria Nigeria's digital economy depends on software in ways that are easy to overlook. Banks and fintech companies rely on interconnected systems to process transactions. Online retailers depend on websites and payment services. Universities operate digital portals. Businesses use cloud applications to manage customers, records, and payments. Publishers also depend on this infrastructure. A website might look simple from the outside, but its security depends on its hosting environment, software, extensions, configuration, and maintenance practices. For a Nigerian business, the consequences of a security failure could include service disruption, loss of access to important records, exposure of customer information, financial damage, and reputational harm. Smaller organisations can face particular difficulties because they may lack dedicated cybersecurity personnel. The problem is not that Nigerian organisations are uniquely exposed to AI-driven vulnerabilities. It is that the same global software weaknesses can affect organisations regardless of their location, while their ability to respond depends on their resources and security practices. This makes routine maintenance more important, not less. A business does not need to develop sophisticated AI systems to improve its security. It needs to understand what software it depends on, keep that software supported, apply important security updates promptly, and know who is responsible when something goes wrong. For website administrators, that includes asking a hosting provider questions that might otherwise go unanswered: - Which PHP version is my website running?- Is that version still receiving security updates?- Who is responsible for applying critical server updates?- How quickly will the hosting provider respond to a serious vulnerability?- Are backups available if the website needs to be restored? These are practical questions, not merely technical formalities. What Website Owners and Businesses Should Do The growing role of AI in vulnerability discovery is a reason to strengthen basic security practices. It is not a reason to panic or assume that every website is about to be compromised. Here are five measures organisations should prioritise. 1. Know What Your Systems Are Running You cannot protect software you do not know you have. Maintain an inventory of important systems, programming languages, applications, plugins, and third-party components. For websites, check whether the hosting provider can identify the software versions running on the server. 2. Apply Security Updates Promptly Updates are not always about new features or visual improvements. Some exist specifically to correct weaknesses that could compromise a system. Organisations should monitor official security announcements and prioritise patches according to the severity of the vulnerability and the exposure of the affected system. For the PHP vulnerabilities disclosed on October 21, the PHP development team identified the patched versions in its official advisory. Website owners should confirm their actual server configuration with their hosting provider rather than assuming that updating a website's content management system automatically updates the underlying server software. 3. Stop Depending on Unsupported Software Software that no longer receives security updates can become a persistent liability. Organisations should plan upgrades away from unsupported versions and products. If an urgent vulnerability affects a system that cannot be patched, they should follow authoritative security guidance on isolating or temporarily taking the affected service offline. A security warning should trigger an assessment, not an assumption that a system is safe simply because it still works. 4. Maintain Reliable Backups Backups cannot prevent every cyberattack, but they can help an organisation recover from certain incidents. Keep backups of essential data and configurations, protect them against unauthorised modification, and test whether they can actually be restored. A backup that has never been tested is not a dependable recovery strategy. 5. Give Someone Clear Responsibility for Security Security failures are not always caused by a lack of available technology. Sometimes, no one knows who is responsible for monitoring vulnerabilities, approving updates, or checking whether a fix was successfully applied. Every organisation should establish clear responsibility for these tasks, whether they are handled internally or by an external service provider. For businesses without dedicated security teams, a competent hosting provider or qualified IT professional can help establish a realistic maintenance process. AI Can Also Help Defenders It would be misleading to present AI as a technology that only benefits attackers. Security teams can use AI-assisted tools to examine code, identify suspicious behaviour, prioritise vulnerabilities, support incident investigations, and help developers understand potential fixes. AI could make security testing more accessible to organisations that previously lacked the resources to conduct extensive manual reviews. It could also help software developers identify defects earlier, before vulnerable code reaches production systems. But these benefits depend on how the technology is deployed. An AI-generated finding must be verified. A proposed fix must be tested. Automated security tools need appropriate permissions and oversight. Organisations must also protect sensitive code and data when using external AI services. Most importantly, identifying more vulnerabilities does not automatically mean fixing more of them. If AI helps an organisation discover a thousand potential weaknesses but the organisation lacks the people, processes, or resources to investigate and repair them, the technology may expose a capacity problem rather than solve it. The objective should not be to discover vulnerabilities as quickly as possible in isolation. It should be to reduce the time between identifying a genuine security problem and making the affected system safe. The Real Test Is Whether We Can Keep Up The internet was not built in a single day, and its security weaknesses will not disappear overnight. It has evolved through decades of software development, accumulated technical decisions, and systems that must continue operating even as new threats emerge. AI is adding a new dimension to that challenge. The technology could help security researchers uncover defects that would otherwise remain hidden. It could also help malicious actors investigate weaknesses more efficiently. The final outcome will depend partly on how effectively software developers, hosting providers, businesses, governments, and security professionals respond. One conclusion is already clear: organisations cannot rely on the assumption that a vulnerability will remain obscure simply because nobody has reported it yet. Security must become a continuous process of discovery, verification, repair, and monitoring. For website owners and businesses, that means taking software maintenance seriously before a security warning arrives. For developers, it means treating secure coding and timely patching as essential responsibilities rather than optional improvements. And for users, it means recognising that the safety of a digital service depends on far more than the interface they see on their screens. AI may be making it easier to find the cracks in the internet. Whether those cracks become disasters will depend on how quickly we learn to repair them. Sources and Further Reading 1. "Reuters: AI-discovered bugs may soon trigger fresh disruptions, cyber experts say" (<a class="tc-blue" href="https://www.reuters.com/legal/litigation/ai-discovered-bugs-may-soon-trigger-fresh-disruptions-cyber-experts-say-2026-10-23/)" rel="noopener noreferrer" target="_blank">www.reuters.com/legal/litigation/ai-d... </a>2. "PHP: Official 2026 security announcements" (<a class="tc-blue" href="https://www.php.net/archive/2026.php)" rel="noopener noreferrer" target="_blank">www.php.net/archive/2026.php) </a>3. "CISA: Critical vulnerabilities in PHP require immediate patching" (<a class="tc-blue" href="https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42ff5ac)" rel="noopener noreferrer" target="_blank">content.govdelivery.com/accounts/USDH... </a>4. "ENISA: Joint statement on critical PHP vulnerabilities" (<a class="tc-blue" href="https://www.enisa.europa.eu/news/joint-statement-on-critical-php-vulnerabilities)" rel="noopener noreferrer" target="_blank">www.enisa.europa.eu/news/joint-statem... </a> About This Article This article distinguishes between documented PHP vulnerabilities, reported trends in AI-assisted vulnerability discovery, and potential future risks. The reported year-on-year doubling of discovered digital flaws is attributed to research cited by Reuters; it should not be interpreted as proof that AI alone caused the increase or that successful cyberattacks have doubled.

Other insights from Galton

Contributor Points

Points-to-Coupons

Referral Earning