Is the Internet Safe? AI-Discovered Flaws Raise Alarms

The security of the internet is facing a new challenge as Artificial Intelligence helps researchers uncover serious software vulnerabilities faster than organisations can respond to them. A series of incidents involving weak encryption keys, PHP, GitLab and Java in October has highlighted how quickly security flaws can emerge, spread and potentially be exploited.

For Cybersecurity teams, the problem is no longer limited to discovering vulnerabilities before malicious hackers do. They must also distribute patches, update affected systems and warn users without giving attackers enough information to exploit the same weaknesses first.

The incidents described in the reports illustrate a growing dilemma for the technology industry: AI can strengthen cyber-defence by identifying weaknesses, but the same capabilities can help attackers analyse vulnerabilities and develop exploits. The result is a race between finding flaws, fixing them and ensuring that the fixes reach every affected system.

A Series of Security Incidents Raises Questions About Internet Safety

On October 20, security teams at major web browsers reportedly received an unusual email containing eight private security keys. These keys had originally been issued by an Indian authority and were intended to support secure communications. However, the keys described in the report were dangerously short, with some consisting of no more than three digits.

One key reportedly contained only the number “4”. The email accompanying the files was signed simply “Wayne”, adding an unusual element to the disclosure.

Private cryptographic keys play an important role in securing digital communications and establishing trust between systems. Their security depends on appropriate generation and protection. Keys that are dramatically shorter than required can undermine the security mechanisms that rely on them.

According to the report, keys of this type should have been 116 digits long. The discovery created an urgent task for cybersecurity teams: revoke the affected keys and ensure that systems no longer trusted them.

Revocation, however, is only one part of the process. Central databases can be updated, and major web browsers generally maintain lists of revoked or untrusted certificates. But not every internet-connected device or application checks those lists or updates its security information automatically.

Some systems require users or administrators to install software updates, while certain command-line tools on macOS may require manual intervention. As a result, a security problem can persist even after the relevant credentials have been revoked centrally.

Why Revoking Weak Security Keys Is Not Enough

The incident involving the short private keys highlights a fundamental weakness in Internet Security: protection depends not only on creating secure credentials but also on ensuring that every relevant system recognises when those credentials are no longer trustworthy.

Modern internet services rely on multiple layers of security, including encryption, certificates, software updates and trusted databases. If one part of this system fails, administrators may need to coordinate changes across a wide range of devices and applications.

Browsers can update their security lists, but other software may not receive the same information immediately. Older systems, specialised tools and applications that depend on manual maintenance can remain vulnerable for longer.

This creates a gap between identifying a security flaw and eliminating its practical consequences. Even when defenders know what has gone wrong, they cannot assume that every affected device has been protected.

The incident also demonstrates why cybersecurity cannot be treated as a one-time exercise. Security teams must continuously monitor systems, verify the validity of credentials and ensure that updates reach all relevant parts of their infrastructure.

PHP Vulnerabilities Force Organisations to Consider Taking Websites Offline

The response to the weak security keys was still under way when another serious problem emerged on October 21. Two vulnerabilities were disclosed in PHP, a programming language widely used to build and operate websites and web applications.

PHP supports a broad range of online services, including message boards, financial portals and government websites. Vulnerabilities in software with such extensive use can have consequences across many organisations, particularly when attackers can exploit the weaknesses remotely.

According to the report, a patch for the PHP vulnerabilities was expected later that afternoon. In the meantime, governments advised affected organisations to take vulnerable systems offline entirely. Several government websites in Europe reportedly went dark as organisations responded to the warning.

Taking a website offline is a significant decision because it can interrupt public services, business operations and access to information. However, temporarily disabling a vulnerable system may be preferable to leaving it exposed to an attack that could compromise servers or data.

The urgency became clearer when details of the PHP vulnerability leaked before the patch was available. The report described the flaw as enabling remote code execution, or RCE, which can allow an attacker to execute unauthorised commands on a vulnerable machine.

Remote code execution is among the most serious categories of software vulnerabilities because it can potentially give an attacker control over a targeted system. The report also noted that a widely shared proof-of-concept demonstrated how straightforward exploitation could be.

For organisations running affected PHP systems, the combination of a serious vulnerability, publicly available technical details and a delayed patch created a narrow window in which defenders had to reduce their exposure.

GitLab and Java Add to the Growing Security Concerns

The security alerts continued on October 22, when two more vulnerabilities were reported in widely used development and programming technologies.

GitLab, a software development platform, announced a patch for a vulnerability affecting 12 years of releases. The flaw was reported to permit remote code execution and received the maximum severity rating of 10 on a ten-point scale.

A vulnerability that affects releases spanning many years can create a complicated remediation task. Organisations may run different versions of the same platform across development, testing and production environments. Identifying every affected installation and applying the appropriate update can take time, especially in large or complex deployments.

Oracle also fixed a serious vulnerability in Java, its widely used programming language. The report assigned the flaw a severity score of 9.1, indicating a high level of concern.

These incidents reinforce the importance of maintaining software inventories, monitoring security advisories and applying vendor patches promptly. Organisations that depend on third-party software cannot rely solely on the assumption that established tools are safe because they have been in use for many years.

The report suggests that AI may have played a role in uncovering these weaknesses, although it does not establish AI involvement conclusively for every incident. What is clear from the reported sequence is that defenders faced several major security issues within a short period.

How Artificial Intelligence Is Changing Cybersecurity

A notable connection between the incidents is the possible role of artificial intelligence in discovering vulnerabilities. The PHP flaw was reportedly identified independently by two members of an AI cyber-defence consortium led by OpenAI. The short security keys may also have been discovered with AI assistance, according to eMudhra, the Indian company that issued them.

AI tools can help security researchers analyse source code, identify unusual patterns, detect weaknesses and examine software behaviour. Tasks that might otherwise require extensive manual investigation can potentially be accelerated by automated analysis.

This capability offers important benefits to defenders. Finding a flaw before it is exploited can give software developers and system administrators an opportunity to correct the problem and reduce the risk to users.

However, identifying a vulnerability is only the beginning of the process. Once information about a flaw becomes public, other researchers and potential attackers can examine the same evidence. AI tools may help them understand the vulnerability, reproduce it and investigate how it can be exploited.

This creates a dual-use problem. Technology that helps security professionals detect weaknesses can also be used to analyse those weaknesses for malicious purposes. The overall security benefit therefore depends partly on how quickly defenders can respond and how responsibly technical information is disclosed.

The incidents do not establish that AI was responsible for every vulnerability or that AI alone caused the reported security failures. Instead, they illustrate how AI-assisted discovery may accelerate an already demanding process for software developers and security teams.

The Race Between Vulnerability Disclosure and Patching

One of the most difficult aspects of modern cybersecurity is deciding when and how to disclose a vulnerability. Researchers and software vendors need to communicate enough information for organisations to understand the risk and prepare a response. At the same time, releasing detailed technical information too early can help attackers identify vulnerable systems.

The PHP incident illustrates this tension. According to the report, defenders were given approximately 18 hours’ notice before a patch was due to be released. The intention was to give organisations time to prepare for an urgent update.

However, a video demonstrating the vulnerability was accidentally released. That demonstration reportedly enabled others, including people using AI tools, to reverse-engineer the issue and work out how to exploit it before the patch was available.

The report also describes a security company publishing its version of the fix six hours ahead of schedule. A patch can reveal important information about the underlying weakness because attackers may compare the corrected code with the previous version to determine what changed.

This technique, often called patch diffing, can help researchers understand the problem. It can also give attackers clues about how to target systems that have not yet been updated.

These events demonstrate why vulnerability disclosure requires careful coordination. Software developers need time to prepare reliable fixes, while administrators need enough notice to test and deploy those fixes. Premature disclosure or an accidental leak can reduce the time available to protect vulnerable systems.

Why Installing Security Updates Remains a Major Challenge

Even when a patch is available, organisations may not be able to deploy it immediately. Large businesses and public institutions often operate complex environments with numerous applications, servers and dependencies. An update that fixes one vulnerability may also require testing to ensure that existing services continue to function correctly.

Administrators must identify which systems are affected, determine whether temporary protections are necessary and schedule updates without creating additional operational risks. Organisations with older software or limited technical resources may face particular difficulties.

Connected systems can also differ significantly in how they receive updates. Some devices install security fixes automatically, while others depend on administrators or users to take action. Certain tools may require manual changes or specific configuration steps.

These differences mean that a patch release does not immediately translate into universal protection. The period between disclosure and widespread installation can become an opportunity for attackers to target systems that remain vulnerable.

Effective cybersecurity therefore requires more than publishing fixes. It also depends on accurate asset inventories, clear communication, timely maintenance and the ability to verify that updates have been installed successfully.

Is the Internet Still Safe?

The incidents described in the report do not mean that the internet has become universally unsafe. Instead, they show that internet security is a continuous process involving software developers, cloud providers, browser teams, governments, businesses and individual users.

Security systems are designed to reduce risks, not eliminate every possible vulnerability. Software is complex, and weaknesses can remain undetected for years before researchers discover them. What matters is how quickly the industry identifies the problem, develops a reliable fix and ensures that affected systems are protected.

AI is changing the speed and scale of this process. It may help defenders find flaws more efficiently, but it can also shorten the time between a vulnerability becoming known and an attacker understanding how to exploit it.

For organisations, the practical response is to maintain up-to-date software, monitor security advisories, prioritise critical vulnerabilities and confirm that patches reach all affected systems. Where an urgent flaw cannot be fixed immediately, temporary protective measures or taking a vulnerable service offline may be necessary.

For users, keeping operating systems, browsers and applications updated remains an important basic precaution. However, many of the incidents described here require action from software vendors and system administrators rather than individual internet users.

The central challenge is becoming increasingly clear: discovering vulnerabilities is only one part of cyber-defence. As AI makes it easier to uncover weaknesses, the ability to communicate securely, deploy fixes quickly and close gaps across complex systems is becoming just as important.

The internet can remain useful and secure, but safety cannot be assumed. It depends on continuous maintenance, responsible disclosure and a race in which defenders must ensure that security fixes reach users before attackers can take advantage of the flaws.