AI Is Finding Software Bugs Faster: How SMEs Can Keep Up

This week offered a clear example of how artificial intelligence is changing cybersecurity. Critical flaws in PHP, the language behind a large share of the world’s websites, forced government agencies, insurers, transport firms and media outlets in several countries to take sites offline while they patched. The bugs were not found by a lone researcher poring over code for months. They were found with the help of AI models. This article is for small business owners, IT managers and web agencies who want to understand what this shift means in practice, without the hype, and how to keep up.

Key takeaways

• AI models are now finding serious, long-hidden software flaws much faster than before.
• That means more security updates, more often, from almost every vendor you rely on.
• Most disclosed flaws never get exploited. The skill is knowing which few to fix first.
• Small businesses can keep up with an inventory, automatic updates and a simple priority rule.

What happened with PHP

According to reporting this week, the security firm Calif found the PHP flaws in August using an OpenAI model during an audit funded by OpenAI, and reported them privately. Wiz, the Google-owned security company, later found them independently, also with AI help. Tenable notes that the earliest affected code path dates back to PHP 5.4.0, meaning the weakness sat unnoticed for many years. After details leaked online, PHP released fixes, and organisations rushed to patch or disconnect servers. Amazon’s threat intelligence team has since said the flaws are being broadly exploited.

A PHP Foundation representative compared the seriousness of the problem to Heartbleed in 2014. The lesson is not only about PHP. AI can now read through huge, old codebases and surface bugs that human reviewers missed for a decade or more.

The bigger trend: more bugs, more patches

Record disclosure numbers

FIRST, the global forum of incident response teams, expects around 66,000 vulnerability disclosures (CVEs) in 2026, and reports that early-year numbers ran well ahead of its original forecast. It names AI tools as one of the drivers, alongside more open-source scrutiny and expanded vulnerability catalogues.

Bigger update bundles

Research published by the Cloud Security Alliance in August pointed to record Microsoft patch releases this summer, with 570 fixes in July and 398 in August, and noted that Microsoft itself linked the surge to AI-assisted discovery. The same research cites Palo Alto Networks’ Unit 42 confirming more than 14,000 previously unknown flaws across nearly 4,000 open-source projects in two months.

Patching is the bottleneck

Finding bugs is getting faster, but fixing them is not. The CSA research notes that a typical remediation cycle of about 55 days no longer matches discovery measured in days, and warns that AI-generated fixes are not yet reliable enough to trust without review. Attackers, meanwhile, are using AI to shorten attack timelines from days to hours.

What this means for small businesses

For a small company in Lagos, Nairobi or Accra, the practical effect is simple: the software you use will need updating more often, and the gap between a flaw becoming public and attackers using it is shrinking. A website left on an old PHP version, a forgotten NAS box or an unpatched router is now more likely to be found and attacked. The good news is that you do not need AI tools of your own to respond well. You need good habits.

The encouraging part

FIRST stresses that only a small share of disclosed flaws need urgent action, mainly those already exploited or likely to be soon, and that this share has stayed fairly steady even as totals climb. A business that focuses on that small set, and keeps everything else on automatic updates, is in a strong position.

A practical plan to keep up

1. Know what you run. Keep a simple list of your website platform and its hosting, your PHP or Node.js versions, routers and firewalls, NAS devices, laptops, phones and key cloud apps. You cannot patch what you do not know about.
2. Turn on automatic updates wherever they are available: Windows, macOS, browsers, phones, WordPress core and plugins, and managed hosting.
3. Use a priority rule. Patch within days anything that is internet-facing and listed as actively exploited, for example in CISA’s Known Exploited Vulnerabilities catalogue. Do not rely on severity scores alone; CSA research found AI could build working exploits for flaws vendors had rated unlikely to be exploited.
4. Retire unsupported software. End-of-life versions of PHP, Node.js, Windows and router firmware get no fixes, however many bugs AI finds.
5. Ask your suppliers. If an agency or contractor manages your website or servers, ask in writing how quickly they apply critical updates and how they will tell you.
6. Review AI-written code and fixes. If your developers use AI coding assistants, treat their output like any unreviewed change: test it and review it before it goes live.
7. Keep backups you can restore. When patching goes wrong or an attack gets through, tested offline backups are what let you recover.

Frequently asked questions

Should we buy AI security tools?

Not necessarily. For most small businesses, a current inventory, automatic updates and a trusted IT provider deliver more value. AI-assisted tools can help larger teams triage findings, but they still need human review.

Does more vulnerabilities mean software is getting worse?

Not exactly. Many of these flaws existed for years. AI is making them visible. In the long run, that should make software safer, provided fixes are actually installed.

Next steps

Pick one hour this week to write down every internet-facing system your business relies on and check that each one is on a supported, up-to-date version. That single list will make every future security alert, from PHP to Node.js to your router, faster and calmer to deal with.

Sources

• Nigeria Communications Week: Government websites go dark as AI exposes critical security flaws
• Tenable: php2shell FAQ
• Help Net Security: AI vulnerability discovery pushing 2026 CVEs toward 66,000
• Cloud Security Alliance: AI discovery outpaces patch capacity

Featured image: Photo: “Programmer’s Laptop” by Wallboat, CC CC0 1.0, via Openverse — source