AICassindra
Research review / safety

AI-Found Bugs Are Now a Weekly Operational Load: Cloudflare's CEO Expects the Sky to Feel Like It Is Falling for Years, and Node.js Credits OpenAI's Codex Security With a Brotli RCE

A Reuters feature published October 24 gathers security leaders after a week of PHP, Node.js, LiteLLM, Railway and eMudhra incidents. They agree that defenders' timelines are shrinking and disagree on whether attacks will rise in step. The Node.js advisory shows what AI-assisted discovery looks like when it goes right.

By Sandeep Belgavi · Published 2026-10-25

On October 24, 2026, Reuters published "AI-discovered bugs may soon trigger fresh disruptions, experts say", by Raphael Satter and AJ Vicens. It surveys a week in which outages spread across government websites in Europe and elsewhere after weaknesses were found in PHP, Node.js and Plex disclosed vulnerabilities, LiteLLM and Railway were breached, and eMudhra's weak keys were recovered by several people. This digest has covered the PHP, LiteLLM, Railway and eMudhra incidents since October 21; the Node.js fix is discussed below.

What the experts said

  • Cloudflare CEO Matthew Prince said he knew of "a bunch of additional severe vulnerabilities that are present in other pieces of critical software", adding: "I think we're going to have a couple years where every single week it's going to feel like the sky is falling."
  • According to Reuters, research due shortly from the threat intelligence firm VulnCheck finds that "AI helped drive a doubling of the number of digital flaws discovered year-on-year." VulnCheck's Patrick Garrity expects "a lot more fire drills for anything that's internet exposed."
  • Shane Fry, CTO of RunSafe Security, said: "What's fundamentally, and unquestionably, changing is the timescale for not only finding vulnerabilities, but how quickly adversaries can weaponize them."
  • Not everyone sees a crisis. curl's lead developer Daniel Stenberg argued that AI-found bugs tend to be exotic and hard to exploit, and ArmorCode's Ramy Rahman said "more disclosed vulnerabilities do not automatically mean more successful attacks."

The good case: a credited AI finding

The Node.js security release of October 21 fixed ten vulnerabilities across the 22.x, 24.x and 26.x lines. The most serious, CVE-2026-111497, is rated High: in the bundled Brotli decoder, "An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer" -- an out-of-bounds write that can lead to remote code execution in any application that decompresses untrusted Brotli data with node:zlib. The credit reads: "Thank you, to OpenAI Codex Security - Khai Tran and Sylvie Mayer for reporting this vulnerability". Fixed versions are 22.23.4, 24.22.1 and 26.12.1; end-of-life lines get no fix. The same release also shipped the CA-certificate update for the eMudhra intermediate compromise.

This is the pattern defenders want: an AI-assisted finding reported privately, fixed by maintainers and shipped across supported branches before details spread. The contrast is PHP2Shell, where Amazon saw exploitation attempts four days before disclosure.

What remains uncertain. VulnCheck's study had not been published when Reuters reported it, so the doubling figure cannot yet be checked, and it is not clear how much of the increase is AI-driven discovery versus more reporting. Reuters does not quantify successful exploitation.

Analysis: Whether or not attacks rise as fast as disclosures, the patch workload already has. Teams should plan for it as capacity rather than treat each event as an emergency. Keep a live inventory of runtimes and embedded libraries, because Brotli was inside Node and Go's certificate fix was inside binaries. Set an internet-facing patch target measured in hours, rehearse it, and keep end-of-life runtimes off exposed paths, since they will not get these fixes. If your organisation uses AI to find bugs in others' code, copy the Node.js model: report privately, let maintainers credit you, and do not publish ahead of the fix.

Sources and evidence

A Reuters feature on October 24 quotes Cloudflare's Matthew Prince expecting years in which every week 'it's going to feel like the sky is falling' and cites unpublished VulnCheck research that AI helped double year-on-year vulnerability discoveries, while others argue more disclosures do not mean more successful attacks; the October 21 Node.js release shows the constructive path, fixing a High-severity Brotli decoder RCE (CVE-2026-111497) reported by OpenAI Codex Security in 22.23.4, 24.22.1 and 26.12.1.