Now the holes are patched while we drive

This is an opinion piece by commentator Ellen S. Viseth, published 26 October 2026, arguing that AI is exposing security holes faster than people can keep up, and that the digital infrastructure society relies on may be more fragile than assumed.

Her main example is PHP, the programming language behind millions of websites. Last week two critical vulnerabilities were found that allowed remote code execution without authentication. Affected operators were told to take servers physically offline and install upgrades quickly. In Norway, the websites of the Directorate for Digitalisation, OsloMet and Feide were shut down. A computer science professor called it about as serious as a web technology vulnerability can get. The flaws had sat in the code for more than ten years, possibly over 20, and were found with the help of several AI tools. Attack code exploiting them appeared the day after the news, security firm Mnemonic saw traffic aimed at Norwegian companies, and Danish ethical hackers estimated at least 21,500 Danish sites were still vulnerable days later.

Epic, the US company behind the Helseplattformen health record system, used Claude Mythos to analyse its own systems. According to the New York Times, it found that some configurations could give access to sensitive patient records without necessarily being logged, and it could not rule out that attackers could alter records Epic indirectly handles for 325 million patients. All development work was paused for six weeks while vulnerabilities were fixed.

Because AI finds vulnerabilities before vendors do, patches are often not ready, leaving organisations exposed in the meantime. Telenor says it has had to patch systems several times in the past year after AI-discovered flaws, and that the pace has risen over the last six months. Its security report says that where there used to be hours or days to act, there may now be only minutes. Telenor Norway head Birgitte Engebretsen describes a dilemma between high uptime and handling zero-day flaws: sometimes there is no chance to test before upgrading, which risks downtime. Since September, Telenor has faced a steady stream of new Netscaler vulnerabilities and patches. She expects exploitation attempts to keep increasing.

Viseth concludes that software may end up stronger and tighter once the flaws are fixed, but for now society is repairing the tracks while the train is moving.