Artificial intelligence is accelerating the discovery of hidden software vulnerabilities so quickly that companies and governments could face repeated emergency patching and temporary service shutdowns, cybersecurity experts have warned.
The warning follows a turbulent week in which serious flaws emerged across widely used technologies including PHP, Node.js and Plex, alongside separate security incidents involving AI gateway LiteLLM, development platform Railway and Indian certificate authority eMudhra.
Cybersecurity firm VulnCheck says AI has helped drive a sharp increase in the number of software vulnerabilities being uncovered.
The concern is not simply that more bugs are being found.
It is that attackers may also be able to turn those discoveries into working exploits much faster than before.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
AI Is Compressing the Time Between Discovery and Attack
Software vulnerabilities have always existed.
Large applications can contain millions of lines of code, making it difficult for human researchers to manually inspect every possible weakness.
AI changes that process.
Models can continuously analyse code, test unusual combinations of inputs and search for weaknesses around the clock.
Tasks that once required experienced researchers days or weeks can increasingly be completed in hours.
Shane Fry, chief technology officer at RunSafe Security, told Reuters that the biggest change is the speed with which vulnerabilities can now be found and potentially weaponised.
That creates a difficult problem for defenders.
Traditionally, software vendors could disclose a flaw, prepare a patch and give customers time to deploy it before widespread attacks appeared.
That window is becoming shorter.
If attackers can produce working exploits within hours, organisations may be forced to patch immediately or temporarily disconnect vulnerable systems.
PHP Flaws Show What Future Cyber Emergencies Could Look Like
The recent PHP security crisis offered an example.
Two critical vulnerabilities were discovered in PHP, the programming language underpinning a huge number of websites.
Governments and organisations across Europe rushed to apply emergency fixes after details of the flaws became public.
Some took websites offline because they could not guarantee that patches would be installed before attackers tried to exploit the weaknesses.
The420.in reported that government websites in Finland and the Netherlands were among the systems affected by precautionary shutdowns.
Cybersecurity researchers observed aggressive attempts to exploit the vulnerabilities.
However, evidence of widespread successful attacks remained limited.
Threat intelligence company Hunt.io said that, as of Thursday afternoon in the United States, the cybercriminal groups it was tracking did not appear to have developed a reliable working exploit.
Cloudflare chief executive Matthew Prince, however, told Reuters he had seen anecdotal indications of some compromises.
That difference illustrates an important point.
Finding more vulnerabilities does not automatically mean attackers can successfully exploit all of them.
Vulnerability Numbers Are Rising Sharply
VulnCheck says the overall volume of vulnerability disclosures is increasing rapidly.
Research due to be published by the company suggests the number of digital flaws discovered has roughly doubled from the previous year, with AI contributing to the increase.
Separate industry data points in the same direction.
The Forum of Incident Response and Security Teams projected in June that around 66,000 CVEs could be disclosed during 2026.
A CVE is the standard identifier assigned to a publicly disclosed cybersecurity vulnerability.
The organisation said AI-assisted security research was one factor behind the rapid growth.
But raw vulnerability numbers can be misleading.
VulnCheck’s analysis of the first half of 2026 found 1,061 vulnerabilities attributed to AI-assisted discovery.
Only 14, or about 1.3%, had confirmed evidence of real-world exploitation.
That was broadly similar to the exploitation rate for vulnerabilities discovered through traditional methods.
In other words, AI is finding significantly more flaws, but those flaws are not automatically more dangerous.
Security Teams Could Face a Prioritisation Crisis
The flood of discoveries creates another challenge.
Security teams do not have unlimited staff or time.
If thousands of new vulnerabilities appear, they must determine which ones need to be fixed immediately and which can safely wait.
AI-generated proof-of-concept exploit code can make that harder.
Some AI-generated exploits are functional.
Others may be incomplete, incorrect or completely unusable.
Defenders therefore risk wasting time investigating vulnerabilities that pose little real-world danger while more serious weaknesses remain exposed.
VulnCheck’s research shows that exploitation speed is nevertheless increasing.
The median period between public CVE disclosure and inclusion in VulnCheck’s known-exploited dataset fell from around 120 days in 2025 to 80 days during the first half of 2026.
For internet-facing systems, the window can be considerably shorter.
AI Could Ultimately Make Software Safer
Not all cybersecurity experts see the acceleration as negative.
Cloudflare’s Prince argued that aggressively discovering old vulnerabilities could ultimately strengthen the internet.
Many of the weaknesses now being found may have existed unnoticed for years.
Leaving them hidden does not make systems safer.
Attackers may eventually discover them independently.
AI could instead allow defenders to find and remove those weaknesses first.
Daniel Stenberg, lead developer of the widely used curl software project, has also cautioned that many AI-discovered vulnerabilities are technically unusual and difficult for criminals to exploit in practice.
The likely outcome is therefore not simply an explosion of successful cyberattacks.
Instead, the security industry may face a period of constant vulnerability discovery, emergency patching and rapid risk assessment as AI exposes weaknesses faster than organisations are accustomed to handling them.
The advantage may ultimately go to whichever side can move faster — the researchers fixing the flaws or the attackers trying to weaponise them.
What this means for you:
For businesses, fast patching is becoming more important as AI shortens the gap between vulnerability discovery and attempted exploitation. Individuals should keep operating systems, browsers, routers and applications set to update automatically wherever possible.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
