AI-discovered software vulnerabilities raise risk of widespread internet disruptions, experts say

WASHINGTON: Advances in artificial intelligence are helping people find security weaknesses in widely used software more quickly. This raises concerns that governments, businesses and internet service providers could face more frequent disruptions because they may not have enough time to fix these weaknesses before attackers use them.

Seven cybersecurity experts told Reuters that using artificial intelligence to examine software code was greatly reducing the time needed to find weaknesses and build tools to attack them.

Research expected to be published by VulnCheck, a cybersecurity intelligence company based in Massachusetts, suggests that artificial intelligence helped double the number of software weaknesses discovered compared with the previous year.

These findings come after several government websites in Europe and other regions experienced disruptions this week. The problems followed the discovery of serious weaknesses in PHP, a programming language widely used to run websites and online services.

The discoveries forced website operators to update their systems urgently. Some temporarily blocked access because they could not finish fixing the security problems before attackers might try to use them.

Matthew Prince, chief executive of internet infrastructure company Cloudflare, said several other serious weaknesses had already been found in other important software products and were being fixed.

He warned that the technology industry could face a long period of frequent security warnings as artificial intelligence finds weaknesses that have gone unnoticed for years.

The PHP incident was one of several cybersecurity developments reported during the week. Others included the discovery of weaknesses in Node.js and Plex, a platform for streaming media.

Other incidents included security breaches connected to LiteLLM, a tool that acts as a gateway for artificial intelligence systems, and Railway, a software development platform. There were also concerns about weaknesses in the methods used to protect digital certificates by eMudhra, an Indian digital certificate provider.

Patrick Garrity, a researcher at VulnCheck, said the number of incidents happening around the same time suggested that organisations running systems connected to the internet could face security emergencies much more often.

One major concern is that the time between finding a software weakness and developing a way to attack it is getting shorter.

In the past, finding complicated software weaknesses usually required special skills. Building tools that could successfully exploit them could take experienced researchers several weeks or months.

This delay often gave software developers and system administrators enough time to prepare, test and release security updates before attackers could take advantage of the weaknesses.

Artificial intelligence is changing this process. It can examine large amounts of software code continuously and help researchers or attackers develop possible ways to exploit weaknesses within hours.

Shane Fry, chief technology officer of cybersecurity company RunSafe Security, said recent advances in artificial intelligence showed that the technology was fundamentally changing how quickly software weaknesses could be found and how much time people had before those weaknesses could be turned into working attacks.

However, cybersecurity experts disagree about whether finding more software weaknesses will necessarily lead to more successful cyberattacks.

Daniel Stenberg, the lead developer of curl, a widely used file transfer tool, argued that many weaknesses found with artificial intelligence were technically complicated and difficult for attackers to use successfully in real situations.

Ramy Rahman, a senior principal solutions engineer at cybersecurity company ArmorCode, also warned that reporting more software weaknesses did not automatically mean that successful cyberattacks would increase by the same amount.

The recent PHP security incident provides an example of this difference.

Cybersecurity intelligence company Hunt.io reported strong attempts to exploit the weakness, matching activity also observed by Amazon and Cloudflare.

However, Hunt.io's head of research, Esteban Borges, said that as of Thursday afternoon in the United States, the attackers the company was watching did not appear to have developed a working tool to exploit the weakness.

Meanwhile, Cloudflare's Prince said he had heard reports suggesting that some systems had been compromised through the PHP weakness, although these reports were based on limited observations.

Despite the immediate disruption, Prince suggested that quickly finding weaknesses that were previously unknown could eventually make the internet safer. Developers and organisations could fix these problems before they remained hidden inside important systems for longer periods.

The immediate challenge for businesses and government agencies is therefore not just the growing number of software weaknesses being discovered. They also have less time to judge how serious each problem is, install security updates and protect their systems from possible attacks.