A wave of software flaws shows how AI could speed up attacks. Experts expect a difficult transition as companies secure old code and users trim digital risks.
A cluster of newly disclosed software flaws and successful hacks points to a difficult period for internet security. The concern is not just the number of incidents this week, but the prospect that tools powered by artificial intelligence will help attackers find and exploit weaknesses faster than organizations can fix them.
On Wednesday, two major vulnerabilities were reported in PHP, a programming language used by about 70 percent of websites. Some organizations, including hospitals and companies, temporarily took digital services offline as a precaution. The flaws had already drawn millions of attempted exploits. That same day, security problems or breaches involving products and platforms used by companies such as Netflix, PayPal and Walmart also came to light. Quest Diagnostics, which conducts lab tests for about a third of American adults each year, disclosed a breach the following day.
Even people who track cyberattacks closely struggled to keep up. Sam Rubin, a senior vice president at Palo Alto Networks, said he had not yet heard about a separate incident involving Railway, a cloud platform used by Intuit and MGM Resorts. “It’s been quite a busy week,” he said.
Why this may become more common
Some security experts have described the run of incidents as “Black October.” Matthew Prince, chief executive of Cloudflare, expects such weeks to become less unusual. He said more flaws in widely used software are likely to surface, and that a wave of disclosures that feels exceptional now could happen every week within months. Prince said he knows of additional vulnerabilities that have yet to be announced.
The underlying problem has been building for years: a large stock of software was written without the scrutiny needed to find every flaw. For a long time, that exposure seemed manageable. But experts say attackers now have access to AI tools that can help identify weaknesses and automate parts of an attack. Rubin said open-source models, which can be downloaded and used without restrictions, have become much better at these tasks in recent months.
That shift can lower the expertise needed to cause harm. Adam Meyers, a senior vice president at CrowdStrike, described an incident involving South Korean banks that the company linked to a 26-year-old in China. After gaining access to data, the person reportedly asked an AI tool how to make money from it. Meyers said the person lacked a clear understanding of what to do next. CrowdStrike, he added, is detecting a new AI-powered hacking operation about every two hours.
Shared software can spread the impact
Flaws in widely used tools can put many organizations at risk at once. Node.js, for example, runs JavaScript code for interactive web pages and is used by large companies and in software built with AI. If attackers compromise one product that depends on Node.js, the effects could spread to many other organizations through a supply-chain attack.
“These are the things the web runs on,” Meyers said. Rubin said a breach involving one Node.js product could affect tens of thousands of organizations. The risk comes from the connections between software: organizations often rely on tools built by other companies, so a weakness in one part of that chain can create exposure elsewhere.
The PHP flaws show how defenses can be coordinated, but also where those efforts fall short. Prince said a group of AI and security firms found the vulnerabilities months ago and worked with industry partners to put temporary protections in place while the weaknesses were addressed. Those shields could reduce exposure for some users, but not every organization uses Cloudflare, and some are slow to install software fixes.
AI could help defenders, too
Some experts expect AI to help security teams find and repair flaws at a much greater scale. That could eventually make the web safer. The hard part is the transition: Alex Stamos, chief information-security officer at Cognition and a former security chief at Facebook, said it may last as long as it takes to rewrite and secure billions of lines of vulnerable code.
AI tools also create new risks. Apps built quickly with AI assistance may contain security flaws, and assistants given broad access to personal accounts or payment details can expose sensitive information. Rubin criticized users who allow an AI assistant, such as Muse, unrestricted access to a credit card. As more people rely on these tools, experts say, the permissions they grant deserve closer attention.
Reducing exposure while defenses catch up
Dan Guido, chief executive of Trail of Bits, expects some companies to remove services from the internet when public access is unnecessary. Retiring old pages and forms can reduce the number of places attackers can probe. Individuals can take a similar approach by removing browser extensions they no longer use, which may have access to personal data.
Stamos said people may need to be more selective about the services they trust, because it will be harder to assume every website is secure. A small hobby site could be compromised and expose a reused password or payment details. Experts also cautioned against taking on complex digital services without the resources to maintain them: large providers such as Google and Dropbox can devote more staff and tools to defending email and file storage than most individuals can.
The longer-term outcome is uncertain. If security teams find and fix enough of the flaws already embedded in software, widely available AI tools could make routine security checks easier and help people share information with greater confidence. But organizations may also concentrate more activity on a smaller number of large providers, whose services are seen as easier to defend. The coming years may test whether better defenses can protect an open web without narrowing the range of services people can safely use.
