随着人工智能能力不断提升，网络安全行业正在迎来新的挑战。Cloudflare首席执行官Matthew Prince日前表示，近期引发全球大量网站紧急修补的PHP安全漏洞可能只是开始，人工智能未来几年还将持续发现更多隐藏在关键软件中的严重缺陷，互联网或因此进入长期动荡阶段。
这场担忧源于最近曝光的PHP重大安全漏洞事件。PHP作为全球最广泛使用的网络编程语言之一，据估计支撑着约70%的网站运行。当相关漏洞被披露后，各国政府网站、数字游戏平台GOG以及众多中小型网站不得不紧急部署补丁，部分机构甚至直接关闭网站以避免遭到攻击。
Matthew Prince透露，Cloudflare目前已经了解到其他关键软件中还存在多项严重安全漏洞，不过相关产品名称暂未公布。他指出，这些问题的严重程度与近期发现的PHP漏洞相当，一旦公开，可能再次引发全球范围的修复行动。
Prince预计类似情况未来将频繁出现。他表示，未来几年中，人们可能几乎每周都会感受到新的安全危机出现，整个行业将持续处于应对重大漏洞的高压状态。
在他看来，变化的核心原因在于大型语言模型的快速发展。过去，无论是安全研究人员还是攻击者，要在庞大复杂的软件代码中寻找漏洞都需要投入大量时间和专业知识。发现一个能够真正利用的漏洞，往往需要专家团队经过数周甚至更长时间的分析。
如今，这种门槛正迅速降低。借助人工智能工具，研究人员可以同时部署多个AI代理自动分析代码库，在数小时内完成过去需要数周时间才能完成的工作。人工智能不仅能够帮助寻找问题，还可以协助构建漏洞利用方式，大幅缩短从发现漏洞到验证风险的时间。
参与发现此次PHP漏洞的网络安全团队Wiz Research表示，先进AI模型在整个研究过程中发挥了关键作用。借助这些工具，研究人员能够快速开发和调整针对多个应用场景的有效攻击验证方案，使原本复杂且耗时的研究工作具备现实可行性。
与此同时，电子前哨基金会（EFF）指出，仅在今年10月，全球已知软件漏洞总数中约有3%是在当月新发现的。安全研究机构VulnCheck的研究也显示，在人工智能辅助下，被发现的数字安全漏洞数量出现显著增长。
不过，专家们认为这并不意味着互联网正在变得更加脆弱。相反，大量潜伏多年、甚至数十年的隐藏漏洞正在被快速暴露出来。虽然短期内会给企业、政府机构和网站运营者带来频繁的修复压力，但长期来看，这些问题被发现并修复后，互联网基础设施反而有机会变得更加安全。
业内分析认为，当前网络安全行业正进入一个新的阶段。人工智能正在同时赋能防御者和攻击者，使漏洞发现、分析和利用的速度都大幅提升。在未来数年里，全球软件开发商、安全团队以及互联网基础设施运营者都将被迫加快更新与修补节奏，以应对AI时代不断涌现的新型安全挑战。
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
As artificial intelligence capacity increases, new challenges are emerging in the cybersecurity industry. The CEO of Cloudflare, Matthew Prince, has recently stated that the PHP security gap that has recently triggered the urgent repair of a large number of websites around the world may be only the beginning, and that artificial intelligence will continue to find more serious deficiencies hidden in key software in the coming years, or that the Internet may enter a long-term volatile phase.
This concern stems from the recent revelations of a major PHP security breach. As one of the most widely used web programming languages in the world, PHP is estimated to support about 70 per cent of the website. When the relevant loopholes were revealed, Governments ' websites, digital game platforms GOG and numerous small and medium-sized websites had to deploy patches on an urgent basis, and some even directly closed the sites to avoid attacks.
Matthew Prince disclosed that Cloudflare was now aware of a number of serious security gaps in other key software, although the relevant product names had not yet been published. He noted that the magnitude of the problems was comparable to the PHP gap recently discovered, and that once made public, it could trigger a global recovery operation again.
Prince expects similar situations to occur more frequently in the future. He indicated that in the coming years, a new security crisis might be felt almost weekly and that the entire industry would remain under pressure to deal with major loopholes.
In his view, the central cause of change was the rapid development of large language models. In the past, the search for loopholes in the vast and complex software codes, both for security researchers and for attackers, required considerable time and expertise. Finding a loophole that can be truly exploited often requires several weeks or even longer analysis by a team of experts.
Today, the threshold is rapidly decreasing. Using artificial intelligence tools, researchers are able to deploy multiple AI proxy autoanalyse the code library at the same time and to complete the work that took weeks to complete in the past within hours. Artificial intelligence can help not only to find problems, but also to build the way to exploit loopholes and significantly reduce the time between the detection of loopholes and the validation of risks.
Wiz Research, a network security team involved in the discovery of this PHP loophole, stated that the advanced AI model played a key role throughout the study. With these tools, researchers are able to rapidly develop and adapt effective attack certification programmes for multiple applications, making otherwise complex and time-consuming research work realistic.
At the same time, the electronic outpost Foundation (EFF) noted that, in October of this year alone, about 3 per cent of the total number of known software leaks globally were newly discovered that month. The VulnCheck study of the safety research institute also showed a significant increase in the number of digital security loopholes detected, supported by artificial intelligence.
However, experts did not believe that this meant that the Internet was becoming more vulnerable. On the contrary, a large number of hidden loopholes that have been lurking for years, if not decades, are being quickly exposed. While there will be frequent repair pressures on businesses, government agencies and website operators in the short term, in the long run, when these problems are identified and repaired, there will be opportunities for Internet infrastructure to become safer.
In-industry analysis suggests that the cybersecurity industry is entering a new phase. Artificial intelligence is empowering both defensive and attackers, making the detection, analysis and use of loopholes much faster. In the coming years, global software developers, security teams and Internet infrastructure operators will be forced to speed up the process of updating and repairing the new security challenges emerging from the AI era.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.