IT Home On October 25, seven cybersecurity experts interviewed by Reuters believe that as AI technology continues to reveal hidden security vulnerabilities in software, events like service interruptions on government websites across the world this week are almost certainly to happen again.
A study to be released by VulnCheck, a network threat intelligence company in Massachusetts, USA, shows that AI has driven an increase in the number of software vulnerabilities discovered. The number of vulnerabilities found over the past year has doubled compared to the previous year.
Matthew Prince, CEO of digital infrastructure company Cloudflare, said: “I know that there are still many serious vulnerabilities in some other key software. … I believe that in the next two years, we will feel like the sky is falling every week.”
He expects that as AI gradually discovers the hidden security risks in internet infrastructure over the long term, the cybersecurity industry will be extremely busy in the next few months.
According to IT Home, this week, government websites in Europe and other regions experienced service interruptions due to a PHP — a well-known programming language widely used on the internet — being found to have security vulnerabilities. Website operators immediately fixed the software to prevent hackers from launching attacks using the vulnerabilities. Some operators were worried they wouldn’t have time to fix it, so they simply shut down the websites until safety was ensured before restoring them.
VulnCheck researcher Patrick Garitti pointed out that urgent fixes for PHP vulnerabilities have added to the already restless cybersecurity industry. This week, PHP alternative technologies such as Node.js and streaming software Plex were also found to have vulnerabilities, and AI gateway LiteLLM and development platform Railway were involved in security intrusion incidents.
In addition, the Indian digital certificate issuing agency eMudhra was found to be using encryption keys with extremely poor security, which could put users across the internet at risk. “If four or five such incidents occur in a week, there will probably be more in the future. As long as the system is directly connected to the internet, urgent security issues may need to be addressed more frequently.”
The code repository of modern software is extremely large, and program errors often hide in unexpected places. Some of these flaws can serve as a foothold for hackers to invade the system.
In the past, discovering program vulnerabilities required certain technical expertise. However, turning those vulnerabilities into attack tools that can break down systems usually required experienced technicians to spend weeks or even months. The long development process gave the defense side a chance to breathe, allowing them to fix the vulnerabilities using the time gap and gradually release software updates.
AI has broken the original time gap. AI models can check software code 24/7, identify vulnerabilities continuously, and develop an attack program that exploits these vulnerabilities within just a few hours.
Sean Fry, CTO of RunSafe Security, a cybersecurity company in Virginia, USA, said that in the past few months, AI models have proven through actual performance that the cybersecurity industry will definitely change as a result. “The fundamental change, and it is indisputable, is time. Not only has the time required to discover vulnerabilities changed, but the speed at which attackers convert vulnerabilities into attacks has also changed.”
Experts who spoke to Reuters agreed that the time available for the defenders to fix vulnerabilities is decreasing rapidly. However, they still disagree on whether AI will lead to an increase in hacking attacks.
Daniel Stenberg, the main developer of the file transfer tool curl, believes that the vulnerabilities discovered by AI models are often special, and it is difficult for malicious attackers to exploit them.
Rami Rahman, senior chief solutions engineer at cybersecurity company ArmorCode, also pointed out: “The increasing number of disclosed vulnerabilities does not mean that successful network attacks will necessarily increase.”
The PHP vulnerability that attracted global attention this week provides some preliminary evidence. The threat intelligence company Hunt.io said that, like Amazon and Cloudflare, it also found frequent attempts by attackers to exploit the vulnerability to launch attacks. However, Esteban Borges, the head of research at Hunt.io, pointed out that as of 14:00 Eastern Time on Thursday, based on the tracking results, cybercriminals have not developed any effective tools that can actually utilize the vulnerability.
Cloudflare’s Prince “has seen” some scattered signs of system intrusions, indicating that these intrusions are related to PHP vulnerabilities. In his view, as AI continuously discovers numerous vulnerabilities, although this may have an impact on the cybersecurity industry, the long-term benefits outweigh the risks.
He compared the entire process to eliminating monsters in a haunted house: facing the monsters head-on is certainly terrifying, but letting them stay hidden behind tightly closed doors is even more serious. “The reality is that we will be able to remove a large number of security risks.”