AI-Assisted Research Exposes Critical Cybersecurity Flaws, Raises Global Security Concerns

New Delhi, Oct 31: The growing use of artificial intelligence in cybersecurity research is bringing both opportunities and new risks to the global technology industry, after researchers uncovered critical software vulnerabilities that had remained undetected for more than a decade, raising fresh concerns about the security of websites and digital infrastructure.

Two serious vulnerabilities in PHP, a widely used programming language that supports millions of websites and online services, were disclosed on October 21. The weaknesses could allow attackers to access vulnerable servers without authentication and execute malicious commands, potentially giving them control over affected systems.

The discoveries have highlighted how artificial intelligence tools are changing the process of identifying software weaknesses, while also increasing concerns that cybercriminals could use similar capabilities to develop attacks more quickly.

The vulnerabilities, collectively known as PHP2Shell, were identified by cybersecurity researchers at Wiz with assistance from artificial intelligence technologies.

PHP is widely used in web development and supports popular content management systems, including WordPress and Drupal, as well as millions of independently developed websites.

Because the programming language is embedded in a large section of the internet’s infrastructure, weaknesses affecting its underlying systems can create risks for organisations operating websites, online platforms and other digital services.

According to the researchers, the two vulnerabilities had existed for more than ten years before being identified. Exploiting them required connecting multiple weaknesses in the way PHP handles information within a computer system.

The research team used Google’s Gemini models and OpenAI’s GPT technology to examine the software code, identify potential weaknesses, develop working demonstrations and test possible security fixes.

The findings demonstrated how artificial intelligence can assist cybersecurity specialists in analysing complicated programming structures and identifying vulnerabilities that may otherwise require extensive manual investigation.

The vulnerabilities received a critical severity rating of 9.2 out of 10, indicating the seriousness of the potential threat.

Researchers demonstrated that the weaknesses could affect applications running WordPress, Drupal and Joomla, making the discovery particularly significant for organisations that rely on these platforms.

PHP released security updates on October 21 and urged website operators to install the fixes immediately.

Organisations using older versions of the software that no longer receive official support may require additional attention, including upgrades or security solutions provided by their technology vendors.

The incident has become part of a wider series of cybersecurity developments reported during October, a period marked by several software vulnerabilities and attacks affecting different parts of the digital ecosystem.

Artificial intelligence is increasingly becoming an important tool for security researchers because it can help examine large volumes of code, identify relationships between different programming errors and test potential methods of exploitation.

Traditionally, discovering a complicated software vulnerability and developing a working demonstration could take weeks or months of specialist work.

AI-assisted tools can reduce the time required for some of these activities by helping researchers analyse code and identify technical patterns more efficiently.

However, the same capabilities could also benefit malicious actors seeking to identify weaknesses in software and develop methods to exploit them.

This creates a growing challenge for cybersecurity teams, which must ensure that vulnerabilities are identified and fixed before attackers can take advantage of them.

The PHP discovery has also drawn attention to the increasing number of software vulnerabilities being reported globally.

Google’s Threat Intelligence Group reported on September 30 that monthly software vulnerability disclosures increased from 5,045 in January to 10,740 in August 2026.

The average number of vulnerabilities exploited each month also increased from 10.5 in 2025 to 18 during the first eight months of 2026.

Google cautioned that automated vulnerability registrations and changes in reporting practices contributed to the increase in disclosures. Therefore, the figures do not establish that artificial intelligence was responsible for every additional discovery or cyberattack.

Nevertheless, the findings underline the growing pressure on organisations to strengthen their security systems and respond quickly when new weaknesses are identified.

The urgency became more apparent after Amazon Web Services reported that its threat intelligence systems had detected an attempted exploitation of the PHP vulnerabilities on October 17, four days before the security updates were publicly announced.

The activity targeted an AWS monitoring system designed to attract and identify suspicious behaviour.

Amazon said it could not establish whether the attempted attack would have succeeded against a real-world system. However, the incident raised questions about whether malicious actors had obtained information about the vulnerabilities before their public disclosure.

On October 26, the US Cybersecurity and Infrastructure Security Agency added both PHP vulnerabilities to its Known Exploited Vulnerabilities catalogue.

The database helps organisations identify and prioritise software weaknesses that have been exploited in real-world attacks.

Further concerns emerged on October 29 when cybersecurity researchers at Palo Alto Networks’ Unit 42 reported active exploitation involving internet-exposed management interfaces of the company’s PAN-OS firewall products.

According to the researchers, attackers combined the PHP vulnerabilities with a separate Linux weakness to gain deeper access to affected systems.

The company said approximately 0.02 per cent of its global installed base had internet-facing management interfaces configured and were affected.

Cybersecurity specialists have stressed that such management interfaces should normally be restricted to trusted networks rather than being directly accessible through the internet.

The reported activity highlighted the importance of securing administrative systems, particularly those responsible for managing critical network infrastructure.

The PHP vulnerabilities were not the only security concerns reported during October.

Researchers also disclosed weaknesses involving Node.js, a technology used for running web applications, and Plex, a widely used media-streaming platform.

Security incidents also affected LiteLLM, an artificial intelligence gateway, and Railway, a software development platform.

Another significant development involved Indian digital security company eMudhra.

Google, Apple and Microsoft stopped trusting certain website-security certificates issued by the company after weaknesses were identified in cryptographic keys used to protect online communications.

The company subsequently announced its withdrawal from the global business of issuing those certificates.

Digital certificates play an important role in establishing trust between websites and visitors. They help verify website identities and support encrypted communication, making their security essential for protecting sensitive information exchanged online.

The developments demonstrated how vulnerabilities can affect different layers of the digital ecosystem, including web applications, software development platforms, network infrastructure and systems responsible for establishing online trust.

India’s financial sector also faced renewed cybersecurity scrutiny on October 30, when the Reserve Bank increased its oversight of lenders following several security-related incidents.

These included the exposure of data belonging to 3,900 State Bank of India customers and more than 700 unauthorised transfers involving two non-bank lenders, valued at approximately USD 2 million, according to a police complaint.

Although the incidents involved different systems and causes, they highlighted the growing importance of cybersecurity as financial institutions and businesses increasingly depend on digital platforms.

The use of AI in cybersecurity is expected to become more significant as organisations seek faster ways to identify vulnerabilities and protect their systems.

Security teams can use AI-assisted tools to analyse software, examine suspicious activity and identify weaknesses before they are exploited.

However, the technology also creates additional responsibilities for companies, which must ensure that their security teams can respond at a speed matching the increasingly rapid discovery of vulnerabilities.

For website operators, the immediate priority following the PHP disclosures is to determine whether their systems use affected versions and ensure that the relevant security updates have been installed.

Businesses operating WordPress-based websites should also check with their hosting providers to confirm that the underlying PHP installations are properly maintained.

Organisations using older or unsupported software may face additional challenges because security fixes are not always automatically available.

Cybersecurity experts also emphasise the importance of restricting access to administrative interfaces, regularly reviewing system configurations and monitoring networks for unusual activity.

For ordinary internet users, the vulnerabilities do not mean that they need to install PHP updates themselves. The responsibility generally lies with website owners, hosting providers and organisations managing the affected infrastructure.

The broader challenge is to ensure that advances in artificial intelligence strengthen digital security rather than creating additional opportunities for cybercriminals.

The October incidents have demonstrated that even long-standing software can contain weaknesses that remain hidden for years. They have also shown that discovering a vulnerability is only the first step in protecting digital infrastructure.

As AI tools become more capable, organisations will increasingly need to focus on rapid security assessments, timely software updates and stronger coordination between technology providers and cybersecurity researchers.

The ability to identify weaknesses before malicious actors exploit them could become one of the most important measures of digital resilience in the coming years.