The WashingtonPost.com published an opinion that “Does something you don’t know exists still exist? The answer is obviously yes. This basic truth is worth keeping in mind in the coming months — and maybe years — as artificial intelligence reveals hair-raising vulnerabilities in the software running the internet and critical infrastructure.” The October 25, 2026 opinion entitled “The best defense against bad AI is more good AI” (https://www.washingtonpost.com/opinions/2026/10/25/ai-is-finding-bugs-faster-let-market-find-fixes/) included these thoughts:
Banks, airlines and government agencies from Japan to Finland scrambled to protect their systems in recent days after AI uncovered two critical vulnerabilities in PHP, a programming language that powers a huge portion of the web. Some entities temporarily shut down online services as a precaution. Hackers were already trying to exploit the flaws, with the cybersecurity company Cloudflare reporting millions of attempts.
Other serious software vulnerabilities emerged around the same time, and more are being discovered with each passing day. The rate of disclosure has skyrocketed. According to Google’s Threat Intelligence Group, the number of software vulnerabilities publicly disclosed each month has more than doubled, from 5,045 in January to 10,740 in August. A separate tracker, using a different tally, records 13,542 vulnerabilities published in just the first 24 days of October, with 16,800 projected for the full month.
The PHP vulnerability hammers home an important point. One of the two flaws was discovered in 2024 by human cybersecurity investigators. They struggled, however, to imagine how it could be exploited by attackers and how to patch it. So the vulnerability remained unfixed. Then, in August, cybersecurity researchers working with OpenAI’s Patch the Planet program used its GPT-5.6 Sol model to demonstrate just how dangerous the flaw was. The discovery prompted an urgent effort by PHP’s developers, assisted by outside researchers using AI, to devise and distribute a fix.
As flaws in software are discovered at an increasing pace, the temptation is to blame AI. After all, before the arrival of advanced models, we didn’t have to worry about these bugs. Worse, there is a temptation to believe the threat comes from open-weight models, freely available tools that admittedly are gaining much of the cyber capability of more locked down frontier solutions.
What do you think?