(REUTERS) – Artificial intelligence is changing the cybersecurity landscape by helping researchers identify software weaknesses that may have remained hidden for years. The discoveries are giving technology companies more opportunities to strengthen their systems, but they are also creating urgent challenges for organizations trying to prevent hackers from exploiting newly revealed flaws.

VulnCheck, a Massachusetts-based cybersecurity intelligence firm, is preparing research showing that reported software vulnerabilities have doubled year over year, with AI playing a significant role in the increase.

Cloudflare CEO Matthew Prince warned that additional serious security problems have already been identified in widely used software. He expects organizations to face sustained pressure as AI tools expose weaknesses throughout the internet’s underlying infrastructure.

“I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,” Prince said.

The consequences were visible this week when security concerns involving PHP, a programming language used by numerous websites, prompted operators to take protective measures. Some organizations temporarily shut down websites rather than risk leaving vulnerable systems accessible while patches were being prepared.

The PHP issue emerged alongside several other cybersecurity incidents. Researchers reported flaws involving Node.js and Plex, while security breaches affected LiteLLM, an AI-related service, and Railway, a software development platform. Separately, concerns surrounding the strength of a cryptographic key used by Indian digital certificate provider eMudhra raised questions about potential risks to online security.

Patrick Garrity of VulnCheck said the concentration of incidents suggested that organizations should prepare for additional urgent security responses.

“If we just saw four or five things like this, this week, I would expect we’re going to see a lot more,” Garrity said. “I think there’s going to be a lot more fire drills for anything that’s internet exposed.”

Hackers and Defenders Face a Faster Race

Software vulnerabilities can emerge in almost any part of a complex computer system. Finding them and developing a reliable way to exploit them traditionally required substantial expertise and time, sometimes giving security teams weeks or months to install fixes.

AI is reducing that advantage. Automated analysis can examine large software projects continuously, helping researchers uncover flaws more quickly. The same technology may also allow attackers to develop exploitation methods at a much faster pace.

Shane Fry, chief technology officer at RunSafe Security, said recent advances have demonstrated how dramatically AI could change the timing of cyberattacks and defensive responses.

“What’s fundamentally, and unquestionably, changing is the timescale for not only finding vulnerabilities, but how quickly adversaries can weaponize them,” Fry said.

For companies responsible for critical online services, the challenge is no longer simply identifying weaknesses. They must also determine which flaws pose immediate danger and deploy effective fixes before malicious actors can take advantage of them.

More Vulnerabilities Do Not Guarantee More Attacks

Cybersecurity specialists agree that AI is compressing the time available to respond to emerging threats, but they remain divided over whether the technology will inevitably produce a major increase in successful hacking incidents.

Daniel Stenberg, who leads development of the curl file-transfer software, has argued that some AI-discovered flaws are technically complicated and difficult to exploit. Ramy Rahman of cybersecurity company ArmorCode has also emphasized that identifying more weaknesses does not necessarily translate into more successful intrusions.

“more disclosed vulnerabilities do not automatically mean more successful attacks.”

The PHP vulnerability offered an example of that distinction. Hunt.io, a threat intelligence firm, observed attempts to exploit the weakness, while Amazon and Cloudflare also reported aggressive activity surrounding the issue.

However, Hunt.io research chief Esteban Borges said that, as of Thursday afternoon, the cybercriminals he was tracking did not appear to have developed a functioning exploitation tool for the vulnerability.

Cloudflare’s Prince, meanwhile, said he had encountered anecdotal indications that some systems had been compromised in connection with the PHP flaw.

A Painful but Necessary Security Overhaul

The growing number of AI-assisted discoveries could lead to more emergency patches, temporary outages and increased pressure on technology teams. Nevertheless, Prince believes the long-term result could be a more secure internet, provided organizations address the weaknesses being exposed.

He likened the process to confronting hidden dangers inside a haunted house: discovering them may be frightening, but allowing them to remain concealed could be considerably worse.

“The reality is, we’re going to get a lot of this stuff cleaned up,” he said.

The central challenge for the cybersecurity industry will be ensuring that defenders can use AI to identify and repair vulnerabilities at least as effectively as attackers can use it to exploit them.