ReadingResearchRadarInvestment framework
Sign in / Sign up
← Back to reading
NewsStructural3 min readDisconfirmAI Editorial

EFF: AI Makes Vulnerability Discovery Cheap, But Open-Source Infrastructure Maintainers Can't Keep Up With the Pace

Using the October 2026 PHP vulnerability incident as an example, the US Electronic Frontier Foundation (EFF) argues that frontier AI models have driven the cost of software vulnerability discovery to extremely low levels, while critical open-source projects remain maintained by a small number of unpaid volunteers. This asymmetry is placing internet infrastructure at systemic risk.

2026-10-24 06:36 GMT+8

The US Electronic Frontier Foundation (EFF) has put forward a structural assessment: frontier AI models are fundamentally altering the cost balance between offense and defense in software security. In the past, discovering zero-day vulnerabilities in specific projects and developing exploits was considered expensive and scarce work requiring specialized knowledge; Google even dedicated an entire team to it. The EFF argues that the situation has now reversed—anyone with moderate technical skills and a few dollars to spend on accessing a frontier AI model can find vulnerabilities within minutes. The article cites a concrete example: recent vulnerabilities in PHP were discovered using a prompt to an AI model that literally said "find bad vulnerabilities in PHP."

The PHP incident itself is a typical case of this asymmetry. The EFF narrates the complete timeline: in 2024, an external security audit identified a potentially severe vulnerability in PHP, but maintainers could not agree on a fix, and more importantly, could not find a way to exploit it. Consequently, they deprioritized the fix to address more urgent security issues. In August 2026, security researchers using the latest models from OpenAI and Anthropic independently rediscovered this vulnerability and another one, and this time found ways to exploit them. The EFF points out that these vulnerabilities were severe enough to allow any creative hacker to take over any website running PHP, steal user data, deploy malware, monitor users, or launch denial-of-service attacks.

Sign in / Sign up
ReadingResearchRadarInvestment framework

The failure of coordinated disclosure exacerbated the consequences. The EFF describes how researchers and PHP maintainers planned to coordinate the release of patches, but news began leaking on October 20th—a post appeared on Hacker News, and one researcher accidentally published a video early. Companies reported observing active exploitation as early as October 17th. On October 21st, six hours before the planned press embargo, the security company Chainguard released a patch early, effectively providing anyone with instructions on where to find the vulnerabilities and how to weaponize them. At the time of the EFF's writing, over 33 million websites were still running vulnerable versions of PHP.

The EFF's core argument is that this is not an isolated incident, but a symptom of a structural problem. Much of the internet runs on open-source software—projects like PHP, OpenSSL, and SQLite are maintained by very few volunteers, sometimes just one person, occasionally receiving a small stipend. Meanwhile, these projects support an internet industry worth tens of billions of dollars. The EFF believes that the accelerated pace of AI-driven vulnerability discovery is overwhelming already overstretched maintainers with more reports, some of which are false positives but many of which are genuine. Burnout in the open-source community has never been more severe. The article concludes that enterprises should proactively provide funding and manpower for the maintenance of these products.

It should be noted that the EFF attributes the surge in CVEs to AI capabilities as its own causal inference, without independent verification provided in the text. Data such as 13,000 new CVE submissions in October alone, accounting for 3% of the historical total, come from the CVE Tracker cited by the EFF, but the specific proportion of AI's role in this has not been quantified. Furthermore, the normative claim that "enterprises should contribute" does not explain why voluntary contributions have consistently failed to reach the required level despite decades of free-rider structures, which remains the weakest link in this argument.

Sources

  • eff.orgElectronic Frontier Foundation↗
Continue researching →