Security Teams Face Accelerating Patch Cycles as AI Finds Bugs Faster

Security teams are confronting a fundamental shift in the vulnerability landscape: artificial intelligence is discovering bugs faster than organizations can patch them, and threat actors have access to the same discovery tools.

Microsoft announced this week it expects a significant increase in Windows security updates as the company deploys AI techniques to find more zero-day vulnerabilities across its codebase. The company stated that advances in AI make it possible to find more issues faster across more code, fundamentally changing the pace of vulnerability discovery. According to Microsoft, the fastest way to reduce customer exposure is finding issues before attackers can exploit them.

The announcement arrives alongside a week of serious security incidents that underscore the challenge. Progress Software urged customers to shut down Windows servers running ShareFile Storage Zone Controllers due to what the company described as a credible external security threat. Progress temporarily disabled access to affected accounts while working with security experts, though the exact nature of the threat remains undisclosed. The company reported no indications of unauthorized access to ShareFile accounts or data, according to AI Watch.

Critical vulnerabilities demand immediate action

Zimbra issued an urgent patch for a critical stored cross-site scripting vulnerability in its Classic Web Client that could enable arbitrary code execution. The flaw allows specially crafted emails to execute malicious scripts in user sessions, potentially exposing mailbox information, session data, and account settings. The vulnerability has not yet received a CVE identifier.

The npm package for Jscrambler was compromised to distribute multiple versions containing a Rust-based information stealer targeting Windows, macOS, and Linux systems. The attack used a compromised npm publishing credential and overlaps with the IronWorm campaign documented by JFrog. The malware has expanded from Linux-only to a three-platform operation with enhanced persistence and automated propagation capabilities.

Threat actors are actively exploiting Citrix Bleed 2 (CVE-2025-5777) to deploy DragonForce ransomware. Huntress reported observing half a dozen intrusions across unrelated organizations in early 2026 using an identical seven-step attack chain, indicating a standardized operator playbook. After gaining access, attackers escalate to SYSTEM privileges, create rogue admin accounts, and establish persistence using legitimate remote access tools like ScreenConnect and Zoho Assist.

AI-powered attacks expand beyond discovery

Researchers detailed a new attack technique called HalluSquatting that exploits AI coding assistants' tendency to hallucinate package names. The method involves registering legitimate-sounding resource names invented by AI agents, then waiting for the assistant to execute malicious code embedded in those packages. The attack combines hallucinations with prompt injections to trick agents into running attacker-controlled instructions.

A large-scale operation codenamed SHELLSTORM targeted more than 1.4 million domains by exploiting 27 CVEs in WordPress plugins to deploy web shells. The campaign, assessed to be the work of a Chinese or Chinese-speaking threat actor, primarily affected systems in Taiwan, the United States, Germany, France, and the United Kingdom. The web shell access enabled deployment of the SNOWLIGHT dropper and VShell backdoor.

Why it matters

The convergence of AI-accelerated vulnerability discovery and AI-powered exploitation tools is compressing the window between patch availability and active exploitation. Organizations must treat AI infrastructure as critical attack surface while simultaneously preparing for increased patch cadence across all systems. The shift from quarterly to continuous patching cycles will require fundamental changes in security operations and resource allocation.

These details were first reported by AI Watch in their weekly security roundup.