Commentary: Patching the holes while we drive, as AI finds security flaws faster

AI tools are now finding and exploiting security flaws faster than people can keep up, and this commentary by Ellen S. Viseth argues that the digital infrastructure we depend on may be more fragile than we thought. Her image is repairing the tracks while the train is moving.

The trigger was two critical vulnerabilities found last week in PHP, the programming language behind millions of websites and web services. They allowed remote code execution without authentication. Affected operators were told to take servers physically offline and install upgrades quickly. In Norway, the websites of the Directorate for Digitalisation, OsloMet and Feide were shut down. A professor of informatics called it about as serious as a web technology vulnerability can get. The flaws had sat in the code for more than ten years, possibly over twenty, and were found with several AI tools. Attack code exploiting them existed the day after the news, security firm Mnemonic saw traffic aimed at Norwegian businesses, and ethical hackers in Denmark estimated at least 21,500 Danish sites were still vulnerable days later.

Epic, the US company behind Norway's Helseplattformen health record system, used Claude Mythos to analyse its own systems. According to the New York Times, it found that some system setups could give access to sensitive patient records without necessarily being logged, and it could not rule out that attackers could manipulate records. Epic indirectly handles records for 325 million patients worldwide. It paused all development work for six weeks to fix the problems.

Because AI finds vulnerabilities before vendors do, patches are often not ready, which leaves organisations exposed in the meantime. Telenor says it has had to patch systems several times in the past year, with the pace picking up in the last six months. Its security report says that where there used to be hours or days to react, there may now be only minutes. Since September, Netscaler has repeatedly found new vulnerabilities and issued new patches. Telenor Norway's chief, Birgitte Engebretsen, describes balancing high uptime against urgent patching as walking a knife edge, and says it may not even be possible to test before upgrading, which risks downtime. She expects exploitation attempts to keep rising, and calls this a serious dilemma for all critical sectors.

The author concludes that software may eventually emerge stronger and tighter, but that the period until then will be bumpy.