AI Is Finding Decades-Old Software Flaws. Is Your Patching Ready?

Some of the software your business depends on every day has had security flaws in it for decades. Nobody knew, because nobody found them. That is changing quickly, and the reason is artificial intelligence.

What was found

On October 20, 2026, the AI company Anthropic published research in which its Claude models examined 25 widely used open-source software projects, more than five million lines of code. Claude flagged 493 issues. One was a pair of settings that conflicted with each other and had been present in the software for 21 years: together, they quietly switched off a requirement that connecting computers prove who they are, so a server set up to accept only trusted clients would accept anyone.

The same research found that in OpenSSH, widely used software for securely administering servers and network devices remotely, about 4,500 lines of code could be reached by anyone on the internet, without logging in, in the default setup of version 10.4, even though the feature that code supported was not turned on. This was unnecessary exposure rather than a known, exploitable flaw. Version 10.5, released August 11, closed off part of it, and version 10.6, released October 6, 2026, completed the fix. Versions before 10.6 still carry some of that exposure.

This builds on earlier work. In April, Anthropic reported that a more capable, restricted model had found a 27-year-old flaw in OpenBSD, a 17-year-old flaw in FreeBSD that let attackers take full control of a server, and a 16-year-old flaw in FFmpeg, widely used video software. Through Anthropic’s partner program, at least 129,000 verified vulnerabilities were found between April and July 2026, more than 33,000 of them rated critical or high.

Anthropic is not alone. The researchers who found the PHP2Shell flaws in PHP this week credited AI models from Google and OpenAI as part of their work. (We covered what PHP2Shell means for your website separately.)

Why this matters to a business that writes no software

You do not need to write code for this to affect you. The flaws are in software that runs inside your web servers, firewalls, storage devices, cloud services and business applications. When those flaws are found, they become patches, and the patches only help you if someone applies them.

Expect more of them, more often. Anthropic’s own advice to organizations is to shorten the time it takes to deploy security updates, tighten enforcement windows and turn on automatic updates where possible, and it expects software makers to issue more emergency releases outside their normal schedules. PHP2Shell, where the release was moved up a day after details leaked, is what that looks like in practice.

There is a second, quieter lesson. Anthropic’s October research argues that turning off or removing features you do not use lowers risk even from flaws nobody has found yet. That is advice any IT team or provider can act on today.

Keep it in proportion

Finding a flaw is not the same as someone exploiting it. One analysis found that only 2 of about 300 vulnerabilities credited to Anthropic or its partners had been exploited by attackers. AI-written fixes also carry risk: one security firm, Veracode, reports that about 44% of AI code-generation tasks introduced a risky vulnerability. The answer is not panic. It is a patching process that can keep pace, with people checking the work.

Technologies to check with your IT provider

These are the technologies named in the research above. Ask whoever manages your systems whether you use them and whether they are current.

• OpenSSH. Used to administer servers and network devices remotely. Version 10.6 is the fixed release. Ask whether your systems run OpenSSH 10.6 or later, or a vendor version that includes the same fixes, and whether remote administration is reachable from the internet at all.
• PHP. The researchers who found PHP2Shell say it powers about 70% of websites. Confirm every site is on a version fixed for PHP2Shell; see our PHP2Shell article for the version numbers.
• FreeBSD. An operating system used on some servers and appliances. Ask whether any of yours run it, and whether the FreeBSD fix (CVE-2026-4747) has been applied.
• Linux. Anthropic reported many Linux kernel flaws that were either unpatched or only recently patched at the time. Ask how quickly kernel updates reach your servers and appliances.
• Web browsers. Anthropic built working attacks against major browsers, and said none had been patched when it reported them. Make sure browsers update automatically on every company computer.
• FFmpeg. Video-processing software found inside many other products. Ask vendors of video, security camera or media systems whether they have updated it.

What to do this quarter

1. Measure your patch speed. Ask your IT provider how long it takes, on average, for a critical security update to be installed on servers, firewalls and laptops. If the answer is weeks, ask what it would take to make it days.
2. Agree on an emergency process. Decide in advance who can approve an urgent patch outside normal maintenance windows.
3. Turn on automatic updates wherever it is safe: laptops, browsers, cloud services.
4. Turn off what you do not use. Ask for a review of internet-facing services and unused features on servers and network devices.
5. Know what you run. You cannot patch software you do not know you have. Keep an inventory, including software inside appliances.
6. Ask your vendors. Software and appliance vendors should be able to tell you how they are responding to the rising pace of disclosures.

Questions to ask your IT provider

• How quickly were critical patches installed on our systems over the last six months?
• Which of the technologies above do we run, and are they up to date?
• What is exposed to the internet that does not need to be?
• What is our process when an emergency patch is released on a Tuesday afternoon?
• How do you check that patches, including any written with AI help, do not break something else?

Request a vulnerability scan

The fastest way to see where you stand is to look from the outside. DLG Services can run a vulnerability scan of your internet-facing systems, such as websites, remote-access services, firewalls and servers, show you what is out of date or exposed that does not need to be, and help you review your patching process.

To ask about a scan, contact us or email robert@dlgservicesinc.com.