Organizations should brace for a stream of software flaws found by artificial intelligence and rethink how fast they install fixes, Michael Daniel, a former White House cybersecurity coordinator, said in an interview with AFP published Saturday. His advice to leaders is that old software and slow patching carry a real price.
What Happened
Daniel, now president of the Cyber Threat Alliance, spoke after a week in which companies and agencies rushed to patch two critical flaws in PHP, the programming language behind a large share of websites. AFP says a powerful OpenAI model found the vulnerability.
"This is the beginning of a pretty chaotic period, given the abilities of the advanced models," Daniel told AFP. He said he expects a flood of vulnerabilities, followed by a flood of patches and mitigations, and that not all of them will be equally good.
He cited Rob Joyce, a former cybersecurity director at the National Security Agency, who has likened the moment to a forest fire that burns away old software. Daniel describes it as technology debt coming due: organizations keep software as long as possible, he said, and its risk is not priced in until an event like the PHP emergency.
Why It Matters
Daniel's case rests on speed. A working demonstration of an attack, known as a proof of concept, once took a month or two to appear and another month or two to reach the ready-made toolkits criminals use, he said. Now he measures that in hours or days. About five or six percent of vulnerabilities have historically been exploited, by his estimate, and he sees no sign that share is rising, but attackers move much faster.
That changes the calculation for large companies, which have long tested patches extensively to avoid breaking systems. Daniel framed it as a hypothetical trade-off: a 1% chance a patch breaks something against an attack that could cost $50 million. Smaller organizations with little in-house capacity, he said, should shift toward accepting vendor updates as fast as possible.
He also warned that many AI-reported flaws are not real or affect software never exposed to the internet, and said the system for sorting genuine findings from noise has to improve.
Context
The interview followed the PHP2Shell disclosures, which tested organizations' patch speed. The Primary Wire reported Friday, citing The Register, that PHP had deferred a fix for a third flaw to its next routine release.
What to Watch
Daniel expects that within two or three years AI will be applied to code before it ships, so less vulnerable software reaches users. That would not solve cybersecurity, he said, but would change its nature. Nearer term, the test is whether organizations can patch in days and sort real AI-found flaws from noise.
