Is this the new cyber normal? (drew.silcock.dev)

A recent surge in software vulnerabilities has raised concerns across the AI/ML community, particularly with the discovery of two critical Remote Code Execution (RCE) bugs in PHP, identified as CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, uncovering flaws in widely used software, were revealed through the use of advanced AI models by security firms, including Calif and Wiz, as part of OpenAI's "Patch the Planet" initiative. The significance of this incident is magnified by the timeline: reports indicate that the vulnerabilities were actively exploited before the security patch was officially released, demonstrating a rapid cycle where vulnerability information can be turned into actual attacks within minutes. The vulnerabilities are estimated to affect around 70% of the internet, impacting major platforms from Wikimedia to UK government websites. This rapid exploitation cycle underscores a troubling shift in cybersecurity, where the time between a vulnerability announcement and widespread attack has dramatically shortened due to the capabilities of AI. LLMs (Large Language Models) can quickly generate exploits from theoretical vulnerabilities, highlighting both the potential for innovation in vulnerability detection and the urgent need for enhanced cybersecurity measures. The situation calls for a reassessment of security protocols as traditional timelines for patching and fixing vulnerabilities become obsolete in the face of AI's swift capabilities.