Quick Summary
On January 27, 2026, OpenSSL announced twelve new zero-day vulnerabilities discovered by an AI system. These vulnerabilities, found during fall and winter 2025, include CVE-2025-15467, a high-severity stack buffer overflow. AISLE is credited with identifying 13 of 14 OpenSSL CVEs assigned in 2025, highlighting the significant impact of AI in cybersecurity.
The Securityish Brief
On January 27, 2026, OpenSSL released details about twelve new zero-day vulnerabilities, all discovered by an AI system. These vulnerabilities were identified and responsibly disclosed to the OpenSSL team during the fall and winter of 2025. Among them, ten were assigned CVE-2025 identifiers, while two received CVE-2026 identifiers. This brings AISLE’s total to 13 of the 14 OpenSSL CVEs assigned in 2025, a remarkable achievement for a single research team.
One notable vulnerability is CVE-2025-15467, a stack buffer overflow in CMS message parsing, rated as HIGH severity by OpenSSL. The National Institute of Standards and Technology (NIST) assigned it a CVSS v3 score of 9.8 out of 10, indicating a critical risk level. This vulnerability is particularly concerning as it is potentially remotely exploitable without valid key material, and exploits have already been developed online.
Interestingly, three of the vulnerabilities had existed since 1998-2000, indicating that they had been overlooked despite extensive audits and fuzzing efforts over the years. One of these vulnerabilities even predates OpenSSL itself, originating from Eric Young’s original SSLeay implementation.
Implications of AI in Cybersecurity
The discovery of these vulnerabilities showcases the evolving role of AI in cybersecurity, enabling faster identification of critical issues. With five of the twelve vulnerabilities, the AI system proposed patches that were accepted into the official release, demonstrating its potential to enhance security measures.
This development is significant for both offensive and defensive cybersecurity strategies, as it emphasizes the need for organizations to stay vigilant. As AI continues to evolve, the speed and efficiency of vulnerability discovery may change the landscape of cybersecurity.
Organizations should consider integrating AI-driven tools into their security protocols to improve their risk posture. The rapid identification of vulnerabilities like those found in OpenSSL can help mitigate potential threats before they are exploited.
Key Takeaways
- Regularly update OpenSSL and other software to protect against newly discovered vulnerabilities.
- Monitor security advisories for updates on vulnerabilities like CVE-2025-15467.
- Consider implementing AI-driven security tools to enhance vulnerability detection.
- Conduct regular audits of your systems to identify potential security weaknesses.
- Educate your team about the importance of patch management and vulnerability awareness.
Key Terms & Concepts
- Zero-day vulnerability: In this article, a zero-day vulnerability refers to a security flaw that is unknown to the software maintainers at the time of its disclosure.
- CVE: CVE stands for Common Vulnerabilities and Exposures, a system for identifying and cataloging publicly known cybersecurity vulnerabilities.
- CVSS: CVSS, or Common Vulnerability Scoring System, is a standardized method for assessing the severity of vulnerabilities.
- Stack buffer overflow: A stack buffer overflow is a type of vulnerability that occurs when data exceeds a buffer’s storage capacity, potentially allowing for code execution.
- Fuzzing: Fuzzing is a testing technique used to identify vulnerabilities by inputting random data into a program to see how it behaves.
Read the original article here: https://www.schneier.com/blog/archives/2026/02/ai-found-twelve-new-vulnerabilities-in-openssl.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
