AI Bug Hunting Is Speeding Up. Can Defenders Keep Pace?

The emergency response to two critical PHP flaws may be an early test of a larger problem for the internet. Artificial intelligence is helping researchers find vulnerabilities faster, while the people responsible for verifying, fixing and deploying patches still have limited time and resources. A Reuters report published on Friday describes security professionals preparing for more episodes in which newly disclosed flaws force difficult decisions across widely used software.

That does not mean AI has suddenly made every website easy to hack. Discovery, a working exploit and a successful intrusion are different stages. VulnCheck’s analysis reports a sharp increase in vulnerability submissions and says about half of submissions to one of its reporting services identify AI as part of the discovery process. It also cautions that a greater number of disclosed flaws should not be confused with the same increase in successful attacks.

The PHP incident made the operational stakes plain. Maintainers released emergency fixes after serious weaknesses were identified in the language runtime behind a vast number of websites. Some public services went offline while operators assessed exposure and installed updates. TechBooky has already covered the patched PHP versions and the precautionary website shutdowns. This follow-up asks what happens if similarly urgent disclosures become more frequent.

A maintainer cannot safely publish every plausible AI-generated finding as soon as it arrives. Each report must be reproduced, distinguished from duplicates, assessed for severity and fixed without breaking the software people rely on. Vendors and hosting providers then need time to package and distribute the patch. Organisations must locate every affected deployment, test the update and confirm the vulnerable process actually restarted. A faster discovery system can put pressure on every link in that chain.

VulnCheck’s earlier research found that the median time between publication of a vulnerability and evidence of known exploitation shortened in the first half of 2026. Its data also indicated that AI-assisted findings were not necessarily more likely to be exploited than other disclosed flaws at that stage. Both observations can be true. The window for defenders may narrow even if most newly reported bugs never become practical attacks.

For companies, the immediate answer is less glamorous than buying another AI security product. Maintain a reliable software inventory, know which supplier is responsible for each component, rehearse emergency deployment and keep a way to isolate exposed services if a fix cannot be installed promptly. For open-source projects, funding triage and maintenance capacity may matter as much as better bug-finding models.

The next wave of AI-assisted findings could ultimately make the web safer by exposing defects before criminals find them. That outcome depends on whether disclosure and repair can keep up. The PHP episode is a warning about the cost of delay, not proof that a permanent cycle of mass outages is inevitable.