AI is changing the cybersecurity landscape by helping researchers uncover long-hidden software vulnerabilities. However, its growing ability to generate fixes and develop exploits is also raising questions about whether automated security can keep pace with the risks it creates.On October 21, PHP released fixes for two critical vulnerabilities that could enable unauthenticated remote code execution (RCE), urging users to update to the latest supported PHP 8 versions. The flaws affect web-facing installations, while unsupported versions may require vendor-provided fixes.The vulnerabilities had remained hidden in PHP’s codebase for more than a decade. Wiz discovered one of the flaws using its autonomous research agent, Wiz Atlas, alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Wiz worked with PHP core developers, OpenAI, and cybersecurity firm Calif to investigate the vulnerabilities, coordinate disclosure, and verify fixes.Sachhin Gajjaer, Founder, CEO & Managing Director of Sattrix Group, explained that AI-powered tools can quickly scan PHP applications and identify potential vulnerabilities, such as SQL injection, cross-site scripting (XSS), and insecure file handling.AI is also becoming increasingly effective at finding weaknesses that conventional tools may miss.Anuj Magazine, Co-Founder and CTO of AI&Beyond, noted that typically, traditional security tools often look for known patterns of mistakes, or throw large amounts of random input at a program to see what breaks. AI can go a step further and examine how different parts of software connect and spot unusual combinations of conditions that create risk.AI is showing real promise with zero-day vulnerabilities — security weaknesses that have not yet been fixed and may be unknown to those responsible for fixing them.In a 2025 contest run by the US defence research agency DARPA, AI systems discovered 18 previously unknown vulnerabilities in real open-source software and submitted 11 patches.However, the use of AI in cybersecurity also carries risks.“Predicting what attackers will do is harder. AI can help identify which known weaknesses might be attractive to attackers, but cannot reliably predict every new attack. AI can also close one security gap and unintentionally open another,” Magazine noted.A 2026 internal study by 1Password examined more than 6,000 AI-generated fixes for six complex security vulnerabilities. Only 26% fully fixed the problem without changing how the software behaved. In nearly 54% of cases, the fixes failed to resolve the vulnerability, introduced another weakness, or both.In another case, Amazon detected an attempt to exploit the PHP vulnerabilities on October 17. The company warned that AI-assisted analysis is lowering the cost of turning vulnerability details into working exploits, allowing more attackers to develop them within hours or even minutes of disclosure.“AI agents can identify vulnerabilities, suggest code fixes, and run automated tests. However, incorrect patches may introduce new vulnerabilities or break application functionality. Human oversight remains essential to review fixes, validate security improvements, and ensure safe deployment,” Gajjaer added.Experts said AI should complement, rather than replace, conventional security testing. While it can speed up vulnerability detection, human oversight remains essential to validate findings, prevent false positives and ensure fixes do not introduce new flaws.Published on October 25, 2026
Click Here For The Original Source.
——————————————————–
