> ## Content Index > Fetch the complete content index at: https://www.cybrsecmedia.com/llms.txt > Use this file to discover other available public pages before exploring further. # AI Is Finding Old Vulnerabilities Faster Than We Can Fix Them - URL: https://www.cybrsecmedia.com/ai-is-finding-old-vulnerabilities-faster-than-we-can-fix-them/ - Published: 2026-10-19T14:06:19.000Z - Updated: 2026-10-19T14:06:36.000Z - Description: LLM-assisted bug hunting is uncovering critical vulnerabilities in old software such as FATFS, exposing a growing cybersecurity problem: AI is accelerating vulnerability discovery while patching and remediation struggle to keep pace. - Author: Michael Farnum - Tags: AI and Vulnerability Management, LLMs, FATFS, blog, CYBR.SEC.Community Sometimes the cybersecurity stories that worry me most aren't about some shiny new attack surface. They're about old technology we've been using forever. That's what caught my attention about the vulnerabilities recently disclosed in FATFS, an open-source file system that's been around for years and is widely used by computers and embedded systems to read storage devices such as flash drives and SD cards. Here's our recent article about it: [AI Found Seven FatFs Bugs. Now Comes the Hard PartAI uncovered seven FatFs flaws affecting embedded devices. The challenge now is patching millions of systems with no easy fix.![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/icon/CYBR.SEC.Media-Logo-copy-b945971e-079b-41d3-997f-c1d8d3b87d74.jpg)CYBR.SEC.MediaGeorge V. Hulme![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/thumbnail/1e0217c1-cbf5-4b7e-a1d6-e957790a6231-86c4821f-e3af-4276-8ef7-147be638b8ce.png)](https://www.cybrsecmedia.com/ai-found-seven-fatfs-bugs-now-someone-has-to-fix-the-devices/) There's plenty to unpack in the vulnerabilities themselves. But what really jumped out at me was how they were found — and what that tells us about where vulnerability management is headed. Researchers had looked at this technology before. Todd Beardsley and HD Moore at RunZero examined it years ago and didn't find anything significant enough to report. Now, using LLM-assisted bug hunting, researchers have uncovered serious vulnerabilities in that same old attack surface. That should get our attention. [Subscribe to the CYBR.SEC.Media newsletter](#/portal/signup/free) ## AI is changing vulnerability discovery We've been talking for a while about what AI will do to vulnerability research. Now we're beginning to see it play out. LLMs can help researchers revisit software that's been around for years — including open-source projects that may never have received the kind of comprehensive security review we'd expect today — and find vulnerabilities that previous research missed. That potentially means a lot more vulnerabilities are coming. And they won't necessarily be confined to the latest operating systems, cloud platforms or AI applications. They could emerge from decades-old software components buried deep inside products and infrastructure. That's where this gets complicated. ## Embedded systems make patching much harder FATFS is particularly interesting because of its use in embedded systems. Think about devices that read storage media for firmware updates and other functions. You don't necessarily patch those systems the way you patch a server or workstation. The vulnerable software might be buried inside firmware. A manufacturer may have modified the original open-source code. Fixing the upstream project doesn't necessarily mean the version running inside a particular device is immediately fixed — or even that the upstream patch will work properly with those modifications. That turns a vulnerability problem into a software supply chain and remediation problem. Organizations first have to determine where the vulnerable component exists. Vendors have to understand whether their implementations are affected. Patches have to make their way downstream. And organizations eventually have to figure out how to deploy those fixes across devices that weren't necessarily designed for easy or frequent patching. That's a much different problem than clicking "update" on a laptop. ## Vulnerability discovery is speeding up. Remediation isn't. That's the larger lesson I take from this. AI-assisted vulnerability research is going to get faster. Researchers are going to revisit old software. They're going to find vulnerabilities humans missed before. And they're going to uncover weaknesses in components that have quietly worked their way into embedded systems and software supply chains over many years. But remediation isn't getting faster at the same rate. That's the imbalance security teams need to start preparing for. If you're responsible for embedded systems, firmware or devices that rely on removable storage for updates, this is worth paying attention to now. Start understanding where these components exist in your environment and how you would determine whether affected versions are present. Because FATFS won't be the last old technology that AI-assisted research puts under a new microscope. And when vulnerability discovery starts moving at machine speed while remediation still moves at supply-chain speed, we've got a problem. [![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/2026/09/2027-Events-Banner.png)](https://www.cybrsecmedia.com/conference/)