AI Found What Humans Missed. Is Your Mainframe Next?

Warum die Verteidigung gegen KI-gesteuerte Bedrohungen jetzt KI an Ihrer Seite erfordert

Quick answer: AI-assisted security research is finding vulnerabilities that survived years, and sometimes decades, of human review, traditional testing, and automated scanning. Recent discoveries in OpenSSL and PHP show the shift clearly. In OpenSSL, an AI-driven security system uncovered 12 previously unknown vulnerabilities, including flaws in code more than 25 years old.

AI didn't suddenly make the mainframe insecure. AI is getting much better at finding the relationships that humans, rules, and siloed tools miss.

That changes the security equation for every mainframe leader. If attackers can use AI to interrogate complex systems, you can't defend those systems without putting AI to work yourself.

In this article, you'll learn:

• What the OpenSSL and PHP discoveries reveal about long-hidden vulnerabilities
• Why AI can spot risks that traditional rules miss
• How mainframe complexity changes in an AI-driven world
• Three principles for a mainframe security posture that fights AI with AI

AI is finding vulnerabilities that survived decades of scrutiny

Few security libraries get more attention than OpenSSL.

In January 2026, OpenSSL disclosed 12 vulnerabilities that AISLE's AI-driven security system discovered. Some of the affected code had existed for decades. Security researcher Bruce Schneier noted that three of the vulnerabilities dated to 1998–2000. They had survived extensive auditing and millions of hours of fuzz testing.

One finding, CVE-2025-15467, was a stack buffer overflow that OpenSSL rated HIGH severity.

These bugs weren't hiding in forgotten software nobody had examined. They sat inside a foundational security technology that researchers had studied intensely for decades.

The vulnerabilities weren't new. The ability to find them was.

Then came PHP. In 2026, AI-assisted research helped uncover critical vulnerabilities in PHP's core engine. Reports indicate the affected code extended back to PHP 5.4, so at least one issue could affect versions from roughly 14 years ago. The flaws enabled unauthenticated remote code execution and earned a 9.2 rating under CVSS 4.0.

Different codebase. Same lesson: age and scrutiny don't prove that you've found every vulnerability.

If you're responsible for decades-old, mission-critical infrastructure, that lesson applies directly to you.

Why AI sees what a traditional rule might miss

A simple analogy helps.

Imagine you manage security for a large office building. One monitoring system reports that a window on the tenth floor is open.

On its own, that may not be a problem. On a pleasant summer afternoon, someone may have opened it on purpose.

Now add more context:

• A severe storm is approaching.
• The window is on the tenth floor.
• Children are using the room.
• The window's safety lock is broken.
• Security records show someone previously fell from that window.

Suddenly, "window open" means something very different.

No single fact proves the building is unsafe. The risk comes from the relationship among the facts.

Traditional tools excel at evaluating conditions they're designed to recognize: if condition X exists, flag condition X. That deterministic approach remains essential. But the most dangerous problems don't always live in a single condition. They can emerge when ordinary conditions across multiple systems combine in an unusual way.

So the real question becomes: what if the vulnerability isn't hiding in one system, but in the relationship between systems?

The mainframe version of the open window

A mainframe is far more complex than an office building. Your security team may need to reason across:

• RACF^®, ACF2^®, or Top Secret^® authorities
• z/OS^® configuration
• Network configuration
• Storage permissions
• Certificates and cryptography
• System and subsystem configuration
• Patches and known vulnerabilities
• Application behavior
• Runtime telemetry
• Operational history and previous incidents
• Organizational security policies

Rocket Software's mainframe security framework treats these as interconnected areas, spanning system software, external security managers, cryptography, storage, network, disaster recovery, and runtime telemetry.

Individually, each signal can look normal. Consider this scenario:

• Security: A service account has permission to access a resource.
• Network: A particular network path is allowed.
• Storage: A dataset is accessible through a configuration that's existed for years.
• Operations: A new workload starts interacting with that resource in an unusual way.

A conventional tool might evaluate each condition independently and report: permission valid, network configuration valid, storage configuration valid.

An AI-assisted investigation asks a different question: what happens when all of these conditions exist at the same time?

The answer could reveal a risk that no individual control was built to flag.

To be clear, an LLM won't magically discover every mainframe vulnerability. Specialized scanners, deterministic controls, vulnerability databases, security expertise, and human validation all remain essential. AI's advantage is correlation. It helps your defenders reason across more context, more domains, and more history than any one person can hold in their head at once.

That's exactly the role Rocket^® EVA.Next^™ plays. It correlates operational and security context across mainframe, distributed, cloud, ticketing, and knowledge sources, so your teams see connections that siloed views hide.

Complexity is no longer a layer of protection

For decades, the mainframe benefited from an expertise moat: specialized architectures, languages, and security models, plus decades of accumulated configuration and operational knowledge. Very few people understood all of it.

AI changes that in two ways.

First, it makes specialized knowledge far easier to access. Someone doesn't need 20 years of mainframe experience to start asking sophisticated questions about an unfamiliar system.

Second, and more important, AI expands how much information someone can consider together. One expert may know RACF extraordinarily well. Another specializes in storage. Another understands z/OS networking. Another knows application behavior. The security issue may live between those domains.

That's why OpenSSL and PHP matter to mainframe leaders. They show that decades of human attention don't guarantee every exploitable condition has surfaced. In OpenSSL's case, vulnerabilities persisted for more than 25 years despite substantial review and automated testing.

Now picture increasingly capable AI pointed at decades of interconnected mainframe configuration, code, security policy, network behavior, and operational history.

Your attack surface didn't change overnight. The ability to interrogate it did.

AI cuts both ways, so your defense has to use it too

This capability works in two directions.

For attackers, AI lowers the expertise and effort needed to understand unfamiliar architectures, analyze code and configuration, correlate public vulnerability intelligence, and map possible attack paths.

For defenders, those same capabilities create a significant opportunity. AI helps your security and operations teams examine relationships that were historically too complex to evaluate at scale.

Here's the strategic reality: you can't counter AI-speed discovery with manual reviews and periodic checks alone. If adversaries use AI to find the gaps, your team needs AI to find them first.

That doesn't mean replacing your scanners. It means using AI to connect what your scanners, security tools, operational telemetry, configurations, and institutional knowledge are collectively telling you.

Specialized analysis finds the open window. AI helps you understand why that open window matters right now.

From scanning for vulnerabilities to understanding risk

A vulnerability scanner asks: "Does this known condition exist?"

A context-aware security investigation asks: "Given everything we know about this environment, what combination of conditions creates risk?"

Those are fundamentally different questions, and you need both answered.

Take another mainframe example. Each of these may be perfectly legitimate on its own:

• A user ID has access to a dataset.
• A network connection exists.
• An application calls a particular service.
• A storage configuration is in place.

But suppose that identity normally reaches the resource from one environment. Now it's accessing it through a network path tied to a different application, shortly after a configuration change, using an authority it hasn't exercised in two years.

None of those observations alone proves something's wrong. Together, they deserve immediate investigation.

That's the opportunity AI creates. It's not just spotting another red light. It's recognizing when several green lights, viewed together, actually add up to a red one.

Stop assuming security. Start continuously interrogating it.

"Is our mainframe secure?" is becoming too static a question.

A stronger question is: "What evidence tells us our mainframe is secure right now, and what relationships might we be overlooking?"

Answering it requires continuous attention to:

• Vulnerability exposure
• Patch posture
• Configuration drift
• Network paths
• Storage access
• Excessive or dormant privileges
• Certificates and cryptographic posture
• Anomalous operational behavior
• Code-level vulnerabilities
• The relationships among all of the above

AI makes it increasingly practical to reason across that entire picture, continuously and without disrupting the systems your business depends on.

Put AI to work on the mainframe, responsibly

Keeping AI away from the mainframe won't protect you from AI-assisted threats. Putting AI to work for your defenders first will. Rocket Software approaches that through three complementary capabilities.

Find more

Use specialized vulnerability analysis to identify known and previously unseen weaknesses. Rocket^® z/Assure^™ VAP examines IBM Z^® at the binary instruction level. It's designed to detect vulnerabilities that traditional enterprise scanning may miss, including flaws in compiled code that source-code tools can't inspect.

Connect more

Use AI to correlate security findings with network, storage, configuration, operational telemetry, historical incidents, enterprise knowledge, and other relevant context.

EVA.Next brings together operational data and institutional knowledge through orchestrated, specialized agents. It analyzes data on-premises, supports RACF, TSS, and ACF2, and connects with tools like ServiceNow, Jira, and Salesforce, so findings flow straight into the workflows your system operators, security, and networking teams already use.
 

Control more

When AI moves from identifying or explaining a risk to taking action, governance becomes mandatory.

Rocket Software's PlanGuard design evaluates proposed tool use at the moment of invocation. It relies on your existing RACF, ACF2, and Top Secret controls rather than replacing them. EVA.Next is agentic, not autonomous: every action stays governed and human-approved. 

Together, these capabilities create a practical security lifecycle:
Discover → Correlate → Understand → Govern → Verify
 

Three principles for a new mainframe security posture

1. Assume undiscovered vulnerabilities exist

OpenSSL offers the clearest warning. AI-assisted research surfaced vulnerabilities that had survived more than two decades of scrutiny. Years of stability don't prove you've found every weakness, so plan your defense around discovery, not assumption.

2. Look for relationships, not only individual findings

Your next meaningful security insight may not be another straightforward misconfiguration. It may sit in the relationship among identity, network, storage, application behavior, and historical context. You need tools that examine those relationships alongside your traditional scanners and controls.

3. Govern whatever AI is allowed to do

Finding something and fixing something are fundamentally different privileges. AI can investigate broadly while identity, authorization, policy, and human oversight tightly control execution. PlanGuard is built around exactly that separation.

Find it before somebody else does

OpenSSL and PHP are signals of something much larger. AI-assisted research proves that vulnerabilities can stay hidden for years, even in mature, heavily scrutinized technologies. PHP flaws reaching back roughly 14 years and OpenSSL flaws more than 25 years old show how dramatically vulnerability discovery has changed.

Humans didn't fail. They finally have a new way to look.

For mainframe organizations, that matters enormously. Your environment holds decades of code, configuration, security policy, network relationships, storage architecture, and institutional knowledge. Traditional tools remain critical, but most were built to find particular conditions within particular domains.

AI connects those domains. It lets you ask not simply "Is the window open?" but "Why is it open, who can reach it, what's happening outside, what happened here before, and does all of that together create a risk we haven't recognized?"

AI will increasingly find what's been hiding in complex systems for years. The only question is who finds it first. Fighting AI with AI, governed and on your terms, puts your defenders ahead.

Talk with Rocket Software about putting governed, agentic AI to work on your mainframe security today.