Cybersecurity defenders have it rough. Sometimes, when a widely used piece of software suddenly develops a vulnerability, the entire industry is forced to spring into action. It is rare, however, for them to have to deal with such a situation multiple times in a single week.
On October 20, the security teams at major web browsers received an unusual email. The message simply stated, “We have a problem here,” and included an attachment containing eight private keys—cryptographic keys, composed of randomly generated numbers, used to secure communications across the internet. For proper security, such keys should be 116 bits long; however, the keys in this email—originally issued by Indian authorities—were no longer than three bits. One of them was only four bits long. Even more baffling was the fact that the email was signed only with the name “Wayne.”
While revoking such keys from a central database is straightforward, ensuring that every individual system has been updated accordingly is a daunting task. Major web browsers regularly update their “blacklist” of revoked keys, but many other connected systems cannot be adjusted so easily. Some—such as many Linux-based systems—require proactive software updates, while others—like certain command-line tools on macOS—must be fixed manually.
Just as security personnel were busy patching these vulnerabilities, another issue emerged on the morning of October 21. Two vulnerabilities were disclosed in PHP—a long-established programming language that underpins tens of millions of web applications, including message boards, financial portals, and government websites. Officials promised to release a patch that same afternoon. In the meantime, affected organizations were advised by various national governments to shut down their systems entirely—a highly cautious directive. Several government websites across Europe were forced to go offline.
As it turned out, this advice was sound. Just hours after news of the vulnerability emerged—and more than 12 hours before a patch was even released—the full details were leaked. The vulnerability is extremely critical: it provides a path for unauthorized remote code execution (RCE), allowing an attacker to take control of a machine running PHP. At least one widely circulated proof-of-concept demonstrates that exploiting this flaw is remarkably simple.
While there is no direct link between the two vulnerabilities, they share a close connection: both appear to have been discovered by artificial intelligence. The PHP vulnerability was independently identified by two members of an AI-driven cyber-defense coalition spearheaded by the American company OpenAI. According to eMudhra, an Indian firm that issues security keys, the flaws in their security keys were “likely” also discovered through the use of artificial intelligence. Naturally, this mode of disclosure points to an unconventional research methodology.
As of October 22, two additional vulnerabilities have come to light. Software development tool GitLab announced a patch for a vulnerability affecting versions released over the past 12 years; the flaw could allow for remote code execution (RCE) and has been assigned a severity score of 10 (out of 10). Meanwhile, tech giant Oracle addressed a similar vulnerability in its widely used programming language, Java, with a severity score of 9.1. It is highly likely that these vulnerabilities were also discovered using artificial intelligence.
These incidents highlight an unsettling reality in the realm of AI-driven cybersecurity: the very process of patching a vulnerability can inadvertently create new opportunities for exploitation. In the case of a PHP vulnerability, details were disclosed 18 hours before the patch was released—a move intended to give defenders ample time to prepare and install updates. However, a video demonstrating the flaw was leaked, enabling others to use AI to reverse-engineer the issue and devise methods for exploitation. Shortly thereafter, a security firm released its own fix six hours ahead of the official patch; this allowed potential attackers to scrutinize the fix, thereby uncovering further details about the vulnerability that could be used to target unpatched systems.
In the past, the challenge for defenders was how to discover vulnerabilities in their own software before attackers did. Today, they face a different problem: as artificial intelligence exposes a vast number of vulnerabilities, how can they inform users about fixes without inadvertently revealing information to adversaries?