Cloudflare warns that AI is accelerating vulnerability discovery, and the internet may face years of security turbulence

The concern stems from the recently disclosed major PHP security vulnerability incident. As one of the most widely used web programming languages in the world, PHP is estimated to support the operation of about 70% of websites. After the relevant vulnerabilities were disclosed, government websites in various countries, the digital game platform GOG, and numerous small and medium-sized websites had to urgently deploy patches, and some organizations even shut down their websites outright to avoid being attacked.

Matthew Prince revealed that Cloudflare currently knows of several other serious security vulnerabilities in other critical software, though the names of the relevant products have not yet been disclosed. He pointed out that the severity of these issues is comparable to the recently discovered PHP vulnerabilities, and that once made public, they could once again trigger a global remediation effort.

Prince expects similar situations to occur frequently in the future. He said that in the coming years, people may feel the emergence of a new security crisis almost every week, and the entire industry will remain under high pressure to respond to major vulnerabilities.

In his view, the core reason for the change lies in the rapid development of large language models. In the past, whether security researchers or attackers, finding vulnerabilities in vast and complex software code required substantial time and expertise. Discovering a vulnerability that could actually be exploited often required an expert team to conduct weeks or even longer of analysis.

Today, that threshold is rapidly lowering. With the help of artificial intelligence tools, researchers can simultaneously deploy multiple AI agents to automatically analyze codebases, completing in a few hours work that previously took weeks. Artificial intelligence can not only help find problems but also assist in constructing exploit methods, greatly shortening the time from discovering a vulnerability to verifying the risk.

The cybersecurity team Wiz Research, which participated in discovering this PHP vulnerability, said that advanced AI models played a key role throughout the research process. With these tools, researchers were able to quickly develop and adjust effective attack validation schemes for multiple application scenarios, making what was originally complex and time-consuming research work practically feasible.

At the same time, the Electronic Frontier Foundation (EFF) pointed out that in October of this year alone, about 3% of the total number of known software vulnerabilities worldwide were newly discovered that month. Research by the security research organization VulnCheck also shows that with AI assistance, the number of digital security vulnerabilities discovered has grown significantly.

However, experts believe this does not mean the internet is becoming more fragile. On the contrary, a large number of hidden vulnerabilities that had lain dormant for years or even decades are being rapidly exposed. Although in the short term this will bring frequent remediation pressure to enterprises, government agencies, and website operators, in the long run, once these problems are discovered and fixed, internet infrastructure may actually become more secure.

Industry analysis suggests that the cybersecurity industry is now entering a new phase. Artificial intelligence is empowering both defenders and attackers at the same time, greatly increasing the speed of vulnerability discovery, analysis, and exploitation. In the coming years, global software developers, security teams, and internet infrastructure operators will all be forced to accelerate the pace of updates and patching to cope with the emerging new security challenges of the AI era.