Quick Buzz Feed

Artificial Intelligence and Cybersecurity: From Vulnerability Discovery to Accountability

Gary Lloyd | Oct 26,26 | 01:36 EST

Technology

‘AI can certainly speed up finding software bugs, but the response’s effectiveness depends on the people involved and the processes they follow.’

The Scale of the Threat On 21 October, governments and companies rushed to install security updates after advanced AI models helped uncover security flaws in PHP (Hypertext Preprocessor), a widely used programming language that powers many of the world’s websites. When the PHP oversight body and the FBI’s cybersecurity division warned of the flaws, governments, businesses, and other operators moved quickly to protect their networks and infrastructure. Although many government websites were back online the next day, some services remained limited as security work continued. This incident highlighted the pros and cons of AI-assisted security research. Artificial intelligence can be a useful tool for discovering vulnerabilities (some of which may be quite subtle), but it also shortens the time an organization has to assess risk, coordinate a response, and protect affected systems. The PHP vulnerabilities are therefore a useful case in point for the wider questions of security governance and institutional readiness. The PHP team had released security updates to fix two serious breakdowns (CVE-2026-109618 and CVE-2026-109619). Attackers could exploit both technical deficiencies over the internet, allowing them to run their own commands on affected computers without needing permission to access them. The European Union Agency for Cybersecurity (ENISA) and the Computer Emergency Response Team for the EU institutions (CERT-EU), which supports cybersecurity across EU institutions, urged organizations to immediately identify affected systems and apply available updates. For operators that could not do so immediately, ENISA and CERT-EU recommended keeping network segmentation in place for any internet-facing applications until they could implement stronger security. The implications of these vulnerabilities extend well beyond PHP-based applications. Many software products and digital services use PHP as part of their architecture and will be affected. When a bug in widely deployed software can disrupt multiple sectors at once, system operators should maintain up-to-date inventories of their software dependencies, identify exposed infrastructure, and apply security measures as quickly as possible. If operators cannot address the vulnerability promptly, they should take appropriate measures to isolate or otherwise protect the affected systems. Defining the Responsibilities of Governance Actors Effective governance requires clearly defined roles, as no single actor can manage the entire response process independently. Developers have to build better tools, researchers have to report responsibly, maintainers have to fix the issue, and operators have to apply the fix. This division of responsibilities helps ensure that issues are not overlooked simply because each party assumes someone else will handle them. Before deployment, AI developers should assess security risks and potential misuse. They should define the system’s limitations, implement appropriate safeguards, and allow reporting of serious issues. Their role is to govern the AI tool, not to secure every system it looks at. NIST’s Cybersecurity Framework 2.0 helps to distribute responsibility and accountability. Security researchers should validate their findings, preserve supporting evidence, and report any serious security flaws through the appropriate channels. Responsible disclosure gives the software vendor time to investigate and develop a fix before the details become public. ENISA can also help coordinate the disclosure process when vulnerabilities affect multiple organizations. Software maintainers must assess vulnerability reports, develop and test fixes, determine which versions are affected, and provide clear guidance to users on how to protect their systems. The EU Cyber Resilience Act imposes specific obligations on digital product manufacturers regarding vulnerability documentation, remediation of security flaws, and providing security updates. For many open source projects, this can be a real challenge when you have limited funds and technical resources. Businesses and public sector entities operating the affected systems should identify software dependencies, determine whether the systems are vulnerable, prioritize risk-based remediation, and apply appropriate updates. If a system operator cannot promptly remediate a serious exposure, they should consider isolating the affected systems or removing them from the network. The Cybersecurity and Infrastructure Security Agency (CISA) recommends that technical institutions prioritize known exploited vulnerabilities. Governments and cybersecurity representatives need to establish clear security standards and reporting procedures so organizations can share information about emerging threats. NIST’s Cybersecurity Framework 2.0 makes it clear that organizations need clearly defined responsibilities, adequate resources, and accountable cyber risk management. These duties are connected but not interchangeable. Each actor must complete its assigned tasks and transfer accurate information to the next stage of the response. However, assigning responsibility is only the first step; governance must also establish how performance will be assessed. Measuring Governance Effectiveness Rules only matter if operators can demonstrate compliance. The governance framework should therefore establish clear, measurable expectations for acknowledging reports, notifying relevant parties, resolving the issue, and confirming that the solution is effective. Response priorities should be based on the vulnerability’s severity and exploitability, the sensitivity of the affected systems, and the possible impact of a compromise. If the issue cannot be resolved immediately, the risk should be documented and temporary safeguards introduced, such as restricting access or increasing monitoring. Independent assessments and post-incident reviews can tell us whether the failure was down to a technical defect, a lack of resources, or a flawed procedure. Their purpose is to fix avoidable weaknesses and improve future responses. The PHP incident is a case in point for how valuable AI-assisted vulnerability discovery really is. It is only as good as the response it elicits. AI can certainly speed up finding software bugs, but the response’s effectiveness depends on the people involved and the processes they follow. We need clearly assigned responsibilities, measurable standards, and accountability at every stage, from discovering a vulnerability to confirming that it has been resolved.

The Scale of the Threat

On 21 October, governments and companies rushed to install security updates after advanced AI models helped uncover security flaws in PHP (Hypertext Preprocessor), a widely used programming language that powers many of the world’s websites. When the PHP oversight body and the FBI’s cybersecurity division warned of the flaws, governments, businesses, and other operators moved quickly to protect their networks and infrastructure. Although many government websites were back online the next day, some services remained limited as security work continued. This incident highlighted the pros and cons of AI-assisted security research. Artificial intelligence can be a useful tool for discovering vulnerabilities (some of which may be quite subtle), but it also shortens the time an organization has to assess risk, coordinate a response, and protect affected systems. The PHP vulnerabilities are therefore a useful case in point for the wider questions of security governance and institutional readiness. The PHP team had released security updates to fix two serious breakdowns (CVE-2026-109618 and CVE-2026-109619). Attackers could exploit both technical deficiencies over the internet, allowing them to run their own commands on affected computers without needing permission to access them. The European Union Agency for Cybersecurity (ENISA) and the Computer Emergency Response Team for the EU institutions (CERT-EU), which supports cybersecurity across EU institutions, urged organizations to immediately identify affected systems and apply available updates. For operators that could not do so immediately, ENISA and CERT-EU recommended keeping network segmentation in place for any internet-facing applications until they could implement stronger security. The implications of these vulnerabilities extend well beyond PHP-based applications. Many software products and digital services use PHP as part of their architecture and will be affected. When a bug in widely deployed software can disrupt multiple sectors at once, system operators should maintain up-to-date inventories of their software dependencies, identify exposed infrastructure, and apply security measures as quickly as possible. If operators cannot address the vulnerability promptly, they should take appropriate measures to isolate or otherwise protect the affected systems.

Defining the Responsibilities of Governance Actors

Effective governance requires clearly defined roles, as no single actor can manage the entire response process independently. Developers have to build better tools, researchers have to report responsibly, maintainers have to fix the issue, and operators have to apply the fix. This division of responsibilities helps ensure that issues are not overlooked simply because each party assumes someone else will handle them. Before deployment, AI developers should assess security risks and potential misuse. They should define the system’s limitations, implement appropriate safeguards, and allow reporting of serious issues. Their role is to govern the AI tool, not to secure every system it looks at. NIST’s Cybersecurity Framework 2.0 helps to distribute responsibility and accountability. Security researchers should validate their findings, preserve supporting evidence, and report any serious security flaws through the appropriate channels. Responsible disclosure gives the software vendor time to investigate and develop a fix before the details become public. ENISA can also help coordinate the disclosure process when vulnerabilities affect multiple organizations. Software maintainers must assess vulnerability reports, develop and test fixes, determine which versions are affected, and provide clear guidance to users on how to protect their systems. The EU Cyber Resilience Act imposes specific obligations on digital product manufacturers regarding vulnerability documentation, remediation of security flaws, and providing security updates. For many open source projects, this can be a real challenge when you have limited funds and technical resources. Businesses and public sector entities operating the affected systems should identify software dependencies, determine whether the systems are vulnerable, prioritize risk-based remediation, and apply appropriate updates. If a system operator cannot promptly remediate a serious exposure, they should consider isolating the affected systems or removing them from the network. The Cybersecurity and Infrastructure Security Agency (CISA) recommends that technical institutions prioritize known exploited vulnerabilities. Governments and cybersecurity representatives need to establish clear security standards and reporting procedures so organizations can share information about emerging threats. NIST’s Cybersecurity Framework 2.0 makes it clear that organizations need clearly defined responsibilities, adequate resources, and accountable cyber risk management. These duties are connected but not interchangeable. Each actor must complete its assigned tasks and transfer accurate information to the next stage of the response. However, assigning responsibility is only the first step; governance must also establish how performance will be assessed.

Measuring Governance Effectiveness

Rules only matter if operators can demonstrate compliance. The governance framework should therefore establish clear, measurable expectations for acknowledging reports, notifying relevant parties, resolving the issue, and confirming that the solution is effective. Response priorities should be based on the vulnerability’s severity and exploitability, the sensitivity of the affected systems, and the possible impact of a compromise. If the issue cannot be resolved immediately, the risk should be documented and temporary safeguards introduced, such as restricting access or increasing monitoring. Independent assessments and post-incident reviews can tell us whether the failure was down to a technical defect, a lack of resources, or a flawed procedure. Their purpose is to fix avoidable weaknesses and improve future responses. The PHP incident is a case in point for how valuable AI-assisted vulnerability discovery really is. It is only as good as the response it elicits. AI can certainly speed up finding software bugs, but the response’s effectiveness depends on the people involved and the processes they follow. We need clearly assigned responsibilities, measurable standards, and accountability at every stage, from discovering a vulnerability to confirming that it has been resolved.