Cybersecurity experts warn that AI accelerates vulnerability discovery, and large-scale security incidents may occur frequently in the coming months

Artificial intelligence is discovering software vulnerabilities at an unprecedented pace, and the cybersecurity industry is facing a structural shock. Multiple industry experts warn that in the coming months, large-scale outage incidents similar to the one that swept government websites worldwide this week will occur one after another.

This week, the programming language PHP was exposed as having a serious security vulnerability, and multiple government websites in Europe and other regions successively had their services interrupted; some operators, unable to complete fixes before hackers exploited it first, were forced to take their websites offline directly. Cloudflare CEO Matthew Prince told Reuters that he is aware of "a large number of additional serious vulnerabilities in other critical software" that are being patched, and predicted that a turbulent period lasting several years will come, in which "every week it feels like the sky is falling."

According to Reuters, seven cybersecurity professionals unanimously agree that the AI-driven wave of vulnerability discovery will almost inevitably trigger more large-scale disruption incidents like this week's. Research about to be released by Massachusetts-based threat intelligence firm VulnCheck shows that the involvement of AI has driven the number of digital vulnerabilities discovered this year to double year-on-year.

Vulnerability discovery accelerates, defense window greatly compressed

In the past, discovering software vulnerabilities required considerable technical thresholds, and turning a vulnerability into a practically usable attack tool (i.e., an "exploit") often required experienced professionals to spend weeks or even months. This time gap once provided defenders with a relatively ample remediation window.

The emergence of AI has fundamentally broken this logic. AI models can scan codebases around the clock, continuously discover vulnerabilities, and complete the construction of attack tools within hours. Shane Fry, chief technology officer of Virginia-based RunSafe Security, said that the actual performance of AI models in recent months has completely dispelled the industry's doubts about whether they can change the industry landscape.

"What is fundamentally and unquestionably changing is the speed of discovering vulnerabilities, and the speed at which attackers weaponize vulnerabilities," Fry said.

VulnCheck researcher Patrick Garrity pointed out that the emergency response to the PHP vulnerability occurred within an already busy week. Security incidents exposed during the same period also include: vulnerability disclosures in the PHP alternative language Node.js and the streaming program Plex, data breaches suffered by AI gateway LiteLLM and development platform Railway, and the discovery that Indian certificate authority eMudhra used extremely weak cryptographic keys, putting internet users worldwide at potential risk.

"If four or five such things happened in this one week, I expect we will see more in the future," Garrity said. "Any system exposed to the internet will face more emergency drills."

Does a surge in vulnerabilities necessarily lead to a higher attack success rate? Experts are divided

Daniel Stenberg, lead developer of the file transfer tool curl, believes that vulnerabilities discovered by AI models often belong to relatively rare "exotic vulnerabilities" that malicious actors find difficult to exploit directly. Ramy Rahman, senior director solutions engineer at cybersecurity company ArmorCode, also said that "more disclosed vulnerabilities does not automatically mean more successful attacks."

This week's PHP vulnerability incident provides some supporting evidence. According to Reuters, threat intelligence firm Hunt.io said that, like Amazon and Cloudflare, it also observed large-scale exploitation attempts targeting the vulnerability. But Hunt.io research director Esteban Borges said that as of 2 p.m. Eastern Time on Thursday, the cybercriminals he tracks did not appear to have successfully pieced together a usable attack tool.

Industry pain may bring long-term security dividends

Matthew Prince compared it to "slaying demons in a haunted house": rather than letting hidden dangers lurk in the dark for a long time, it is better to confront them head-on. "The reality is that we are going to clean up a lot of these problems," he said.

For investors, this trend means demand in the cybersecurity sector will continue to expand. Digital infrastructure companies such as Cloudflare, as well as security vendors focused on vulnerability management and threat intelligence, are expected to continue benefiting from this round of AI-driven security arms race. At the same time, the spending pressure on various enterprises in security compliance and emergency response will also rise accordingly. Risk disclosure and disclaimer

Markets carry risks, and investment requires caution. This article does not constitute personal investment advice, nor does it take into account the special investment objectives, financial conditions or needs of individual users. Users should consider whether any opinions, views or conclusions in this article are suitable for their particular circumstances. Investment based on this is at the user's own risk.