The lead story in cybersecurity news today is not a single flaw. Reuters reported on October 23, 2026 that AI has helped drive a doubling in the number of software flaws discovered year on year, citing research from VulnCheck, a Massachusetts threat intelligence firm. Seven cybersecurity professionals spoke to Reuters, and their shared point is simple: the bugs were already there. What changed is how fast they are being found, and how fast a found bug can be turned into a working exploit. Cloudflare CEO Matthew Prince told Reuters he is aware of a bunch of additional severe vulnerabilities sitting in other pieces of critical software, and predicted busy months ahead.
The short answer: Reuters reported that flaw discovery has doubled, citing VulnCheck research that has not been published yet. Exploit timelines have shrunk from weeks to hours, and the practical question for any team is no longer whether an emergency disclosure will hit their stack. It is whether they can patch, shield, or take a system offline inside a day when it does. The readiness check below scores exactly that.
Put as a plain number, Reuters reported that the discovery of software flaws rose by 100 percent in a single year, citing the VulnCheck research due out in the coming days. Finding a bug used to take a baseline level of skill, and building a digital lockpick from it, an exploit, could take an experienced professional weeks or months. That gap gave defenders breathing room: a flaw could be fixed and the update rolled out gently before anyone weaponized it. Reuters reports that AI has thrown those assumptions out. Models can subject a codebase to round-the-clock scrutiny, find one bug after another, and turn around exploits in hours.
Shane Fry, chief technology officer of Virginia-based RunSafe Security, told Reuters the demonstrated performance of AI models over the past few months had settled any doubt about whether they would change the industry. What is fundamentally changing, he said, is the timescale: not only how fast vulnerabilities are found, but how quickly adversaries can weaponize them.
Prince put the near future plainly in his Thursday interview with Reuters: "I think we're going to have a couple years where every single week it's going to feel like the sky is falling." He said AI is surfacing long-hidden weaknesses in the fabric of the internet, and that he expects busy months ahead as more of them come out.
VulnCheck researcher Patrick Garrity told Reuters the scramble to fix PHP came during an already busy week. These are the stories Reuters listed, with our checks for the ones that have one:
| Story | What happened | Our check |
|---|---|---|
| PHP | Two critical flaws in the PHP runtime (PHP2Shell, CVSS 9.2) forced an emergency release. Government websites across Europe and elsewhere went offline, some taken down by their own operators who could not patch before attackers moved. | PHP2Shell check |
| Node.js | Security releases for the 22.x, 24.x and 26.x lines fixed ten flaws, including a high-severity out-of-bounds write in the bundled Brotli decoder. | Node.js Brotli check |
| LiteLLM | A breach tied to the widely used AI gateway, in a week when a tampered LiteLLM release also circulated. | Release swap check |
| eMudhra | The Indian certificate authority had used cryptographic keys Reuters described as extraordinarily flimsy, putting users across the internet at risk. The company then voted to exit the global SSL/TLS business. | eMudhra CA keys check |
| Plex | A vulnerability disclosure in the streaming program added one more patch-now item to the same week. | No standalone check; the readiness score below is the response |
| Railway | A breach tied to the development platform rounded out the week Garrity described. | Standalone check: Railway breach key rotation |
One week, six fire drills, and that was before the VulnCheck numbers land. If Prince is right that more severe flaws are already sitting in other critical software, this cadence is the new normal, not a bad week.
Reuters is clear that the experts agree on shorter timelines and split on what follows. Daniel Stenberg, the lead developer of the curl file transfer tool, argued the vulnerabilities AI models find tend to be exotic bugs that are difficult for rogue actors to take advantage of. Ramy Rahman, a senior principal solutions engineer at ArmorCode, said more disclosed vulnerabilities do not automatically mean more successful attacks.
The PHP flaw gave early evidence for the cautious side. Threat intelligence firm Hunt.io said it had, like Amazon and Cloudflare, seen aggressive attempts to exploit the bug. But its head of research, Esteban Borges, said that as of 2 PM Eastern Time on Thursday, October 22, the cybercriminals his firm tracks appeared to have failed to build a working tool for it. Prince, for his part, told Reuters he had seen anecdotal evidence of compromises linked to the PHP vulnerability. Both reports stand; neither is proof on its own.
Prince also gave the optimistic reading. The deluge will rattle the industry, he said, but it should be a net positive in the end: the flaws get cleaned up instead of lurking quietly where anyone who finds them first can use them in private. That is the real choice the doubling creates. Hidden bugs do not stay hidden anymore. They surface in public, on a clock defenders can plan around, or they surface in an attack.
Answer for the stack you actually run, not the one in the policy document. Five questions, scored in your browser; nothing is sent anywhere.
BreachHunter, Ingenious AI's intrusion and breach-signal hunter, is built for the gap this new rate creates: the hours between a disclosure landing and your patch being verified live, when the question stops being are we exposed and becomes did anyone get in. When fire drills arrive near-weekly, that gap is where breaches hide. Get early access on WhatsApp.
1. What did the VulnCheck research Reuters cited find?
2. What did Cloudflare CEO Matthew Prince predict?
3. As of 2 PM Eastern on Thursday, October 22, what had Hunt.io found about exploitation of the PHP flaw?
4. What did curl lead developer Daniel Stenberg argue?
5. When an emergency disclosure hits your stack, what is the right first move?
The AI-discovered bug surge is the sharp rise in software flaws being found now that AI models can read codebases around the clock. Reuters reported on October 23, 2026 that AI helped drive a doubling in flaws discovered year on year, based on VulnCheck research. The bugs are not new. Many sat hidden in old code for years. What is new is how fast they surface, and how fast exploits follow.
No. The flaws Reuters describes were written by people, in some cases many years ago. The PHP flaws behind this week's government site outages had sat in the code since 2012. AI changed the search, not the code: models can subject a codebase to constant scrutiny that human reviewers never had time for, so long-hidden mistakes are being found in batches instead of one at a time.
The reports conflict, and this page keeps both. Hunt.io said the criminals it tracks had failed to build a working exploit tool as of 2 PM Eastern on Thursday, October 22, despite aggressive attempts that Amazon and Cloudflare also saw. Cloudflare CEO Matthew Prince told Reuters he had seen anecdotal evidence of compromises linked to the flaw. Attack traffic is confirmed. A finished tool, so far, is not.
Not automatically, and the experts Reuters quoted are split. Curl lead developer Daniel Stenberg argued that AI tends to surface exotic bugs that are difficult to exploit. ArmorCode's Ramy Rahman said more disclosed vulnerabilities do not automatically mean more successful attacks. Prince argued the cleanup is a net positive in the end: bugs that stay hidden stay available to anyone who finds them quietly.
Start with a list. Write down every internet-facing system you run and the exact version it runs, because the first hours of an emergency disclosure go to teams who already know their exposure. Then set a same-day patch path for critical fixes, agree in advance who can shield or take a system offline, remove end-of-life software, and have one person watch disclosures daily.
Sources: Reuters, October 23, 2026 (the VulnCheck doubling figure, the Prince, Fry, Stenberg, Rahman and Borges interviews, the government outage recap, and the week-in-review list) · VulnCheck research as reported by Reuters; the research itself was not yet published when Reuters wrote, and this page attributes the figure to Reuters throughout.