BSSN Says It Is Mapping Exposed Systems as AI Speeds Up the Discovery of Software Flaws

Indonesia’s National Cyber and Crypto Agency (BSSN) says it is working with operators of electronic systems to find and patch exposed assets as artificial intelligence uncovers software vulnerabilities at a faster pace, CNN Indonesia reported on November 4. BSSN spokesperson Prabaswari said the agency had published security advisories on its website and through IDSIRTII, held a readiness assembly with cyber incident response teams (TTIS) on October 22 and 23, and opened technical assistance for organisations dealing with a vulnerability in the PHP programming language.

BSSN is also verifying and mapping assets with electronic system operators (PSE) to identify systems that may be affected, and is applying the same approach to flaws in Node.js, monitoring their impact on Indonesian assets and telling system managers how to fix them. The agency is trying to be proactive rather than wait for incidents, Prabaswari said. She stressed, however, that patching remains the responsibility of each system operator, with BSSN supporting through notifications, guidance and technical help. As discoveries accelerate, including those aided by AI, the ability to detect and patch has to move even faster, she said.

The comments follow a period in which AI tools were linked to several new findings, including flaws in Node.js, a data leak tied to the LiteLLM developer platform and weak cryptographic keys at the Indian certificate authority eMudhra. Prabaswari said the LiteLLM case shows that updates from trusted sources can be compromised, while the eMudhra case shows that weaknesses at one certificate provider can affect users across borders. Major browsers have already withdrawn trust in the problematic certificates, she said, so the public mainly needs to keep browsers and operating systems updated.

What it means in practice

For government systems, BSSN named unpatched software, dependence on third-party open-source libraries and trust in digital certificate infrastructure as the main risks. Its recommended first response is to check whether systems are affected, isolate them, preserve logs as evidence, patch or upgrade, rotate exposed credentials and report to BSSN. Longer term, it urges asset inventories, retiring end-of-life software, checking the integrity of software packages, least-privilege access and security by design. The advice builds on BSSN’s call for data centres to form CSIRTs and adopt post-quantum cryptography and sits alongside the AI ethics and safety regulations that reached final State Secretariat review with BSSN.

What to watch is how quickly operators of public services act on the advisories, whether BSSN publishes figures on affected systems, and how often AI-driven discoveries of this kind recur.