AI is finding 40 years of old bugs faster than humans can fix them

Three stories in one week told the same story from three angles. On 30 October Robert Haas, one of the core developers of PostgreSQL (a free database that runs inside a huge share of the world's apps and websites), wrote a post titled 'Postgres 19 is late, and it's AI's fault'. On 2 November IEEE Spectrum, the magazine of the world's largest engineering association, described a flaw called PHP2Shell that put sites from NASA to Wikipedia at risk, and quoted a researcher saying 'all the legacy software that was written by humans over the last 40 years is being exposed.' On 4 November OpenAI published a report on pointing its newest cyber-focused AI at the Linux kernel (the core of the operating system that runs most servers, clouds and Android phones).

All three reached the top of Hacker News, the tech community's news board, and all three make the same point: AI has made finding bugs dramatically cheaper. The people who have to fix them are still the same people.

PostgreSQL. For a decade, new major versions have shipped between mid-September and mid-October. Version 19 will most likely arrive in November, and three big features were pulled late in testing. Haas's numbers: fixes that had to be copied back into the release being finished rose more than 60% compared with the same months of 2025, and fixes copied back into the previous release as well jumped more than 74%, from 248 to 433. His explanation is that 'a huge number of people on the Internet are now reporting bugs in PostgreSQL that they found using LLMs' (large language models, the technology behind ChatGPT and Claude). AI can draft fixes too, he writes, but they 'aren't always correct', so humans still review and commit every one, 'and those humans have not gotten any smarter between 2025 and 2026.'

PHP2Shell. PHP is a programming language from 1994 that still runs WordPress, Drupal and countless older sites. The bug behind PHP2Shell was reported in 2024 as a mere crash, the kind of report that sits in a queue for years. Earlier this year the security firm Calif, sponsored by OpenAI, audited PHP and, with AI tools, turned that crash into a way to run any code on the server within two weeks. Disaster was avoided: it was reported privately and patched before attackers found it. But it took four engineers two months to build that patch. Columbia University's Suman Jana summed up the problem: 'There is a fundamental asymmetry in finding bugs and fixing bugs.'

Linux, by OpenAI's numbers. In mid-October OpenAI ran a pipeline of AI agents built on an unreleased cyber model over the Linux kernel. It flagged 2,308 possible bugs, reproduced 1,724 of them in test machines, and produced 948 distinct 'local privilege escalation' exploits: ways for an ordinary user on a computer to make themselves its administrator, called 'root'. The whole run cost about $1.2 million in API fees; each successful exploit cost about $359. OpenAI notes that at past hacking-competition prize levels those exploits would be worth $19 million to $66 million. Ten days after the scan, 61 had been fixed upstream, 43 had fixes waiting and 299 were being reported. In July, an earlier model running the same kind of search found 166. These are OpenAI's own figures in its own report.

The long tail of fixing. A separate example shows what happens after a fix exists. A critical flaw in how Linux handles incoming internet connections, CVE-2026-98432, scored 9.8 out of 10, was reported by an Anthropic researcher, whose Claude model wrote a working attack. The Linux developers shipped a four-line fix on 11 and 15 October. Red Hat shipped fixed versions on 1 November. As of 5 November, according to a tracker by Atlas Security, Ubuntu (one of the most widely used server versions of Linux) still listed its main long-term releases as vulnerable, with fixes in testing.

And it is spreading to amateurs. TechCrunch reported on 5 November that a robotics startup founder found a severe flaw in software used by Ubuntu and Debian servers by asking OpenAI's GPT 5.6 Sol to find bugs 'as bad or worse' than one he had found years ago. It came back in two hours. He says he spent about $5,000 on subscriptions and tokens in total.

Imagine an old apartment building where every flat has small cracks, leaky pipes and loose wiring that nobody ever noticed. One day the building gets an inspector with X-ray vision who walks through every flat in an afternoon and leaves a list of 2,000 problems on the caretaker's desk. The building did not get worse overnight. It was always like this. But there is still one caretaker, the list is now taller than the desk, and burglars can hire the same X-ray inspector.

That is what is happening to the software the world runs on. Most of it is maintained by small teams, often volunteers, and the AI inspector works far faster than they can repair.

Software has always had more bugs than anyone could fix, and automated bug-finding is old. In 2014 Heartbleed, a flaw in the free OpenSSL encryption library, showed that critical internet software was being kept alive by a handful of underpaid volunteers. 'Fuzzers', programs that throw random input at software until it crashes, have produced floods of bug reports since the 2010s; Google's OSS-Fuzz has reported thousands. Those floods were mostly crashes. What is new is that AI does the hard part fuzzers could not: working out which crash is dangerous, writing a real attack to prove it, and doing it in hours for a few hundred dollars. PHP2Shell is exactly that: a 2024 crash report nobody prioritised, turned into a skeleton key.

We have been tracking this curve. In August OpenAI warned that one of its own unreleased models was a 'critical' cyber risk. In October we wrote about Claude cracking a 1997 cryptography puzzle in half an hour, and about Google limiting Gemini 4 Carbon to vetted cyber defenders. This week is the first time the cost shows up in ordinary release schedules and patch queues.

For everyone: install updates promptly. Johns Hopkins professor Matthew Green's advice in the IEEE piece is the most useful sentence in this whole story: when your phone or laptop offers a security update, 'don't wait till next week. Just do it.' Fixes are now arriving faster than ever, and so are the people looking for unpatched machines.

For builders and companies in Oslo: assume the old code you depend on will be scanned by someone's AI, friendly or not. The defensive move is to scan it yourself first, keep dependencies current, and budget human time for reviewing fixes, because that is now the bottleneck. OpenAI has announced a $1 billion programme for defenders of critical infrastructure and says it is spending a 'significant amount' of computing on open-source fixes, but TechCrunch points out its Linux scan cost about $1.2 million, a small sum next to the scale of the problem.

The measured view: this is mostly good news delivered in an uncomfortable way. Bugs that would have stayed hidden for decades are being found by defenders first, and Haas thinks PostgreSQL's delay reflects its care for quality. The worry, which Haas also voices, is the backlog: 'given that we have forty years of bugs that humans were unable to find but LLMs are quite capable of discovering, how are we ever going to catch up?' Nobody has a full answer yet.