AI-Found Software Flaws Raise Fears of Further Cyber Disruption
Cybersecurity specialists warn that artificial intelligence is accelerating the discovery of software weaknesses. Critical PHP fixes this week illustrate the pressure on organisations to patch systems before attackers can exploit them.
Cybersecurity teams are being pressed to fix serious software faults more quickly as artificial intelligence shortens the time needed to uncover vulnerabilities, according to specialists interviewed by Reuters.
The warning follows an unusually disruptive week for internet operators. Security weaknesses in PHP, a programming language used by a substantial number of websites, prompted emergency software releases on 21 October and precautionary shutdowns at some online services while administrators assessed their exposure.
Seven cybersecurity professionals told Reuters that AI tools have made it easier to inspect large codebases and identify errors that might previously have remained hidden for years. Research being prepared by vulnerability intelligence company VulnCheck suggests the number of reported flaws has risen sharply, although an increase in discoveries is not the same thing as an increase in successful attacks.
Cloudflare chief executive Matthew Prince told the agency he expected further serious software weaknesses to emerge. Other specialists were more cautious, noting that a bug identified by an AI system may still be difficult to turn into a working attack.
The immediate issue for UK websites
PHP's maintainers issued fixes for two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. Both were given severity scores of 9.2 under the CVSS 4.0 system.
The PHP project says affected installations serving web requests should upgrade to a patched version: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on the software branch in use. Older unsupported branches also require attention because they no longer receive the same security maintenance.
NHS England's cyber alert, published on Wednesday, describes a risk of unauthorised code execution or access to sensitive process memory. The alert applies to organisations responsible for vulnerable servers; it does not mean every website that uses PHP has already been compromised.
For UK businesses, charities and public bodies, the operational challenge is straightforward but demanding: identify affected systems, install the appropriate fixes and confirm that critical services continue to run correctly. A security patch applied late can leave an opening; a rushed change made without testing can disrupt a service in its own right.
Evidence about attacks remains mixed. Reuters reported widespread attempts to exploit the PHP weaknesses, alongside analysis suggesting some early attempts had failed. Confirmed compromises and attempted intrusions must therefore be treated separately.
AI-assisted testing may ultimately help defenders remove long-standing faults. In the meantime, the speed of discovery is forcing organisations to rethink how rapidly they can respond when a critical vulnerability becomes public.
Musa Ersoy
Musa Ersoy is an editor and writer at DEFUXA Global News, covering developments in the United Kingdom and around the world. He researches news stories using official statements, credible sources and independently verifiable information. His editorial work focuses on factual ac…
Author profile and articles