AI Accelerates Cybersecurity Threat Detection as Digital Risks Increase

According to Saednews, Artificial intelligence (AI) is playing an increasingly important role in identifying software vulnerabilities, analyzing cyber threats and accelerating security responses, experts said, as the discovery of the high-severity PHP2Shell vulnerability underscores the need for faster and more comprehensive cybersecurity measures.

The PHP2Shell vulnerability, which received a severity score of 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS), allowed attackers to remotely execute code and compromise web servers, potentially exposing websites and platforms to security breaches.

Kubra Kalkan Cakmakci, an associate professor of computer engineering at Istanbul-based Ozyegin University, told Anadolu that AI significantly speeds up software debugging and can assess millions of potential errors simultaneously.

She said AI could examine multiple layers of the PHP2Shell vulnerability at once, a process that would take considerably longer for human analysts, who typically investigate only a limited number of steps at a time.

“AI was able to analyze multiple layers quickly and simultaneously when detecting the PHP2Shell vulnerability, whereas humans can only work through and consider a few steps at a time,” she said.

Cakmakci emphasized that effective cybersecurity requires a comprehensive approach addressing every layer of a system, with organizations prepared to respond to critical security breaches.

“Ensuring cybersecurity against vulnerabilities requires a holistic approach that addresses all layers, and organizations must have solutions in place to deal with critical security breaches,” she added.

Beyond the challenges of identifying vulnerabilities, the potential exposure of sensitive user information remains a major concern.

Fatih Sensoy, a senior security researcher at cybersecurity firm Kaspersky, told Anadolu that the PHP vulnerability had forced numerous websites and platforms into maintenance mode and could expose plain-text session data and other sensitive information, including credit card details.

He said storing personal information in encrypted formats within separate databases could provide additional layers of protection. However, he warned that attackers who gain control of a frequently used website could potentially compromise everything accessible through it.

“Storing personal data in an encrypted format in a separate database on the server could provide a few additional security mechanisms. However, once a frequently used website falls into an attacker's hands, everything beyond that point is at their mercy,” he said.

Meanwhile, Sensoy warned against assuming that AI can independently identify every software vulnerability, explaining that initiatives such as Patch the Planet depend on human experts to guide the technology toward potential weaknesses.

He also highlighted the limited time developers have to address newly disclosed vulnerabilities, noting that developing and releasing a security patch could take several days, while attackers might already be examining the vulnerability for ways to exploit it.

“An update is released to fix the vulnerability, but developing a patch could take two to three days. In cybersecurity, however, even an hour is crucial. Anonymous attackers are also monitoring these updates, with the sole aim of discovering how to exploit a disclosed vulnerability,” he said.

Sensoy said organizations therefore need rapid-response mechanisms to minimize the damage caused by newly discovered security flaws, noting that similar vulnerabilities have emerged in the past and will continue to pose challenges in the future.

“Such vulnerabilities have emerged before, are being disclosed now, and will continue to emerge in the future. When faced with such incidents, we must have rapid-response solutions in place to minimize the damage,” he added.