Artificial intelligence is helping security researchers identify software vulnerabilities and develop fixes, but the same capabilities are allowing attackers to find weaknesses and exploit them faster. This is increasing the pressure on businesses to patch their systems before cybercriminals can take advantage of the flaws, experts told CNBC-TV18.

The issue has come into focus after several government websites across Germany, France, the Netherlands, Belgium and Denmark were taken offline following the discovery of two critical vulnerabilities in PHP, a programming language used to power a large number of websites.PHP developers have released updates to address the vulnerabilities and urged users to install them immediately. However, releasing a fix does not eliminate the risk if businesses continue to run affected software without applying the update.

Rajesh Chhabra, general manager of India and Asia at Acronis, and Mohit Anand, CEO and co-founder of Mitigata, said the growing use of AI was changing the speed of cyberattacks, making timely patching and basic cybersecurity measures more important.

How is AI helping attackers exploit software vulnerabilities?AI can help security researchers identify flaws in software and develop fixes. Attackers can use the same technology to analyse vulnerabilities and work out how to exploit systems that remain unpatched. Chhabra said the PHP incident demonstrated how AI could benefit both cybersecurity defenders and malicious actors. Once developers release a patch, attackers can examine the changes to understand the weakness that has been fixed and develop an exploit targeting systems that have not yet been updated.“The gap between a patch and a working exploit is now measured in hours, not weeks,” Chhabra said.

This leaves businesses with less time to respond.

A software update may address a known vulnerability, but organisations that delay installing it could remain exposed while attackers work on ways to exploit the flaw. The challenge, therefore, is not simply to make patches available but to ensure that affected systems are updated quickly.

Is AI creating new cybersecurity vulnerabilities? Not necessarily. Chhabra said the vulnerabilities exploited in these incidents were conventional software weaknesses that could have been targeted even without AI. The technology is making it easier and faster to exploit such flaws rather than necessarily creating them.“The vulnerabilities that were exploited to gain access to these entities were actually conventional vulnerabilities. AI did not hack into these systems. It only used vulnerabilities that already existed,” he said. This distinction matters because businesses do not need to wait for a new AI-driven threat to emerge before strengthening their defences.

Outdated software, unpatched systems and a lack of visibility into the technology an organisation uses can leave it exposed to attacks. Chhabra said businesses should start by identifying their software inventory, the versions in use and the systems that have not been patched.

This would help them establish where weaknesses exist and prioritise their security efforts. Why are outdated PHP websites a concern?PHP is used by servers to build website content before sending it to a visitor's browser. A vulnerability in the programming language can put websites running affected versions at risk if attackers exploit the flaw. The problem extends beyond PHP. Anand pointed to patches released for other software, including GitLab and Node.js, saying that vulnerabilities across multiple platforms had made timely updates increasingly important. He also highlighted the continued use of older PHP versions.

Anand said around one in three PHP websites was still running versions 7 and 5, accounting for 33% of websites in the category he was discussing. He called on businesses using these versions to upgrade to PHP 8. The figures illustrate a challenge for website operators: even when developers release fixes, organisations may continue using older software or fail to install the necessary updates. Their exposure can persist until they address the underlying issue.

Why are smaller businesses also at risk? Cybersecurity threats are no longer limited to large enterprises and financial services companies. Smaller businesses are also being targeted, Anand said, even though they may have fewer resources to manage software updates or respond to security incidents.“It's no longer just enterprises or mid-market companies. Smaller companies are also being targeted, and that's the sad part,” he said. Limited IT budgets and a lack of in-house expertise can make it harder for smaller businesses to identify vulnerabilities and apply fixes promptly. For companies without the necessary technical staff, Anand recommended approaching their website hosting providers for assistance.

He also called for greater awareness and cooperation across the cybersecurity community, including webinars to help businesses understand how to respond to threats. Governments, he said, should help ensure that companies lacking the necessary resources can upgrade their software.

What should businesses do to reduce their exposure? The experts' recommendations centre on identifying weaknesses, applying fixes and ensuring that organisations have the resources to respond to threats. Businesses should maintain an inventory of their software and the versions they use, identify unpatched systems and prioritise updates for affected software.

They should also assess whether older versions need to be upgraded and seek help from hosting providers if they lack the technical expertise to do this themselves. Chhabra said organisations needed to build a robust security framework, starting with an understanding of their existing systems. Anand stressed the importance of investing in cybersecurity rather than treating it as a concern only for large companies. The urgency has increased as AI makes it easier for attackers to identify and exploit weaknesses.

Businesses that cannot establish which systems need attention may struggle to respond before those weaknesses are targeted. What risks do autonomous AI agents pose?AI-assisted exploitation is not the only concern. Chhabra also referred to cases involving AI agents and bots that exceeded the authority assigned to them. He said these agents were supposed to operate within a sandbox, a controlled environment that limits what they can do.

However, they went beyond those boundaries and accessed website scripts or executed code they were not supposed to handle. Such incidents raise questions about whether the restrictions placed on automated systems are sufficient. Businesses need to consider not only software vulnerabilities but also the permissions granted to AI agents and whether those systems remain within their authorised limits. The PHP incident and the concerns around autonomous agents highlight different aspects of the cybersecurity challenge. AI can accelerate the exploitation of existing software weaknesses, while poorly controlled automated systems can create additional risks.

For businesses, the immediate priority remains clear: they need to know which software they are running, identify vulnerabilities and apply fixes promptly. As the time available to respond to an attack shrinks, the effectiveness of a security patch will depend increasingly on how quickly organisations put it into practice.