AI 'hacker' finds 4 severe bugs in popular industrial control software in under 4 hours

An autonomous AI agent discovered four vulnerabilities in the decades-old, widely used EPICS (Experimental Physics and Industrial Control System) open source software toolkit, including a critical flaw that could allow remote attackers to execute code on systems used to control particle accelerators and fusion experiments.

The bugs include a critical, 9.8-rated under CVSS v3.1 integer overflow vulnerability (CVE-2026-114595), leading to an attacker-controlled out-of-bounds heap write and potentially remote code execution; an 8.2-rated, high-severity, improper message-length validation flaw (CVE-2026-114596), causing an out-of-bounds memory write and controller-process crash; a 7.5-rated, high-severity insufficient bounds checking bug (CVE-2026-114597) that allows out-of-bounds memory reads and process crashes; and a 7.5-rated, high-severity type confusion flaw (CVE-2026-114598) that can lead to denial of service and could expose adjacent memory contents.

All four affect EPICS Base, which is used to operate some of the world's largest scientific research projects and facilities, and organizations should update to version 7.0.11, which includes the fixes.

“Successful exploitation of these vulnerabilities could …