Cyber — 2026-10-24

AI-Powered Vulnerability Discovery Triggers Unprecedented Wave of Zero-Days Across Open Source Software

BLUFAI-accelerated vulnerability discovery has already outrun the open source ecosystem's ability to patch, giving attackers a structural timing advantage that scheduled remediation cycles cannot close.

The PHP project shipped emergency patches on October 21 for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), which DEV Community reports affect every PHP version back to 5.4 1. The same source reports Calif found them in August using OpenAI's GPT-5.6 Sol, Wiz independently reached the same flaws, and Amazon's MadPot honeypot recorded exploitation attempts on October 17, four days before disclosure 1. EFF states that October saw multiple potentially internet-breaking disclosures and that researchers have found nearly a quarter of all software security issues ever discovered this year 2. Google Threat Intelligence Group data show monthly CVE disclosures doubled to 10,740 in August, and attackers exploited an AI-found BeyondTrust flaw within four days of disclosure 3. Resilient Cyber cites open source maintainers' limited remediation capacity 4.

Analysis
Open source maintainers and enterprise patch teams now face a discovery rate that outpaces remediation capacity, and coordinated disclosure no longer protects defenders. Exploitation attempts on the PHP flaws began four days before the embargo lifted, and attackers weaponized an AI-found BeyondTrust flaw within four days, so organizations relying on scheduled mass patching will fall behind. Those that triage by threat intelligence and deploy WAF rules before patches will hold the advantage. Since April's reporting on restricted models finding thousands of bugs, AI-found flaws have reached a critical core-engine vulnerability exploited in the wild. Confidence is high because four outlets converge on the direction of change and a vendor dataset confirms the timeline, though all are secondary or advocacy sources. The surge may partly reflect more reporting and CVE assignment rather than greater risk, and the PHP leaks stemmed from embargo failures, not AI.

5 sources

AI Found the PHP Zero-Day First. Now What? - DEV Community
Computer Security Is About to Get a Lot Worse, Heres What You Can Do - EFF
The vulnerabilities AI finds are the ones attackers want - Help Net Security
Vulnpocalypse: AI, Open Source, and the Race to Remediate - Resilient Cyber
PHP Warns Admins of Two Critical Flaws, Emergency Patches Coming Tomorrow - BleepingComputer