A Cloudflare speaker says Log4j-scale flaws now come weekly, some from teens

A speaker from Cloudflare said on the No Priors podcast that flaws as serious as Log4j, once a yearly event, now arrive weekly. The speaker also said some recent big finds came from high school kids with AI agents, not nation states. This is one company's view, and no incident counts were given.

What was said

On the episode "Democratizing Security for the Agentic Web", the speaker said reports in the CVE list, the shared catalogue of known software holes, had risen "exponentially" over three to six months. Log4j and Shellshock-style crises once meant all hands on deck about once a year. Now, the speaker said, they happen weekly. Not all are public.

The host asked who is behind the finds. The speaker said some larger recent flaws did not come from nation states. They came from high school kids who treat it like a capture-the-flag contest, point agents at a target and collect bug bounties. Nation states had such tools for longer, the speaker said. Now the masses have them.

The mechanism is stamina. "AI can just do all these things that doesn't sleep." One human red-team engineer cannot match that. The speaker added that better harnesses, the ways people run frontier models, matter as much as better models.

As an example, the speaker cited a same-day report of a key behind web encryption that was started from the single number four. The speaker did not say who found it or how, and we could not confirm the report. The weakness is simple: a key built from a guessable starting number can be rebuilt by trying likely numbers.

Why it matters

Our reading: when finding flaws gets cheaper and never stops for sleep, the defender's workload grows, not just shifts. If the speaker's weekly pace holds, managers should plan for patching as a standing routine, not a yearly emergency. The speaker expects most teams' time to go to security within 18 months.

Questions to ask now. What is our deadline for patching a critical flaw, and could we meet it every week? How quickly do vendors tell us about problems? Which assets sit behind zero trust, where no device is trusted by default, and which still rely on a castle-and-moat perimeter? The speaker said firms that moved to zero trust are better placed.

The other side

The speaker expects this surge to be a short transition. At some point, the speaker said, AI will have surveyed most of the code and found most of the bugs. That is an expectation, not a measured result.

The evidence is also thin. It is one company's view with no counts of weekly incidents. The speaker said "some" larger flaws came from teenagers, not most. The key report was new. A host raised air-gapping critical systems, meaning cutting them off from the internet. The speaker answered that industry rivals tend to team up in a crisis. Whether defenders can keep pace was left open.