{"id":26640,"date":"2026-09-18T16:00:00","date_gmt":"2026-09-18T16:00:00","guid":{"rendered":"https:\/\/www.securitytoday.de\/?p=26640"},"modified":"2026-11-13T16:04:54","modified_gmt":"2026-11-13T16:04:54","slug":"how-ai-accelerates-vulnerability-discovery","status":"publish","type":"post","link":"https:\/\/www.securitytoday.de\/en\/2026\/09\/18\/how-ai-accelerates-vulnerability-discovery\/","title":{"rendered":"How AI Speeds Up Vulnerability Discovery"},"content":{"rendered":"<p style=\"color: #b8c5ce; font-size: 0.92em; margin: 0 0 20px;\"><strong>Advertisement<\/strong> \u00b7 Partner content from F5, placed through Fink &amp; Fuchs. The SecurityToday editorial team formatted the text.<\/p>\n<p><strong>Modern software is changing ever faster, so traditional testing processes can no longer detect all potential new vulnerabilities. Generative AI enables large-scale, real-time analysis of source code and, in some cases, binaries and compiled code. It replaces neither secure development nor human assessment. Vendors must integrate AI-based vulnerability discovery into a process covering analysis, prioritization, verification, remediation and evidence of effectiveness.<\/strong><\/p>\n<div style=\"background: #003340; color: #fff; padding: 32px 36px; margin: 32px 0; border-radius: 8px;\">\n<p style=\"color: #69d8ed; text-transform: uppercase; letter-spacing: 0.08em; font-size: 0.82em; font-weight: bold; margin: 0 0 16px;\">Key takeaways<\/p>\n<ul style=\"margin: 0; padding-left: 20px; line-height: 1.7;\">\n<li style=\"margin-bottom: 10px;\"><strong style=\"color: #69d8ed;\">Pressure from two sides:<\/strong> ENISA counted 4,875 incidents. Software supply chain vulnerabilities remain an access route, while AI accelerates attacks and creates new attack surfaces.<\/li>\n<li style=\"margin-bottom: 10px;\"><strong style=\"color: #69d8ed;\">AI needs a process:<\/strong> analysis, prioritization, verification, remediation and evidence of effectiveness. A finding counts only once its impact is reproducible.<\/li>\n<li style=\"margin-bottom: 0;\"><strong style=\"color: #69d8ed;\">Update cycles tighten:<\/strong> Quarterly patches are no longer enough. F5 is moving to a more frequent release schedule.<\/li>\n<\/ul>\n<\/div>\n<p style=\"border-top: 1px solid rgba(230,227,218,0.14); border-bottom: 1px solid rgba(230,227,218,0.14); padding: 14px 0; margin: 28px 0; font-size: 0.92em; color: #b8c5ce;\"><strong style=\"color: #69d8ed;\">Related:<\/strong> <a href=\"https:\/\/www.securitytoday.de\/en\/2026\/07\/04\/vulnerability-triage-cvss-alone-misguides-prioritization\/\">Vulnerability triage: CVSS alone points the wrong way<\/a>  \u00b7  <a href=\"https:\/\/www.securitytoday.de\/en\/2026\/06\/08\/api-security-the-blind-spot-behind-every-integration\/\">API security: the blind spot behind every integration<\/a><\/p>\n<p>The European Cybersecurity Agency ENISA analyzed a total of 4,875 incidents from July 2024 to June 2025 in its <a href=\"https:\/\/www.enisa.europa.eu\/publications\/enisa-threat-landscape-2025\">Threat Landscape Report 2025<\/a>. It names the compromise of software in the digital supply chain through discovered vulnerabilities as an important access route for attackers. At the same time, it describes artificial intelligence as a factor that both optimizes attacks and creates new attack surfaces at companies. This puts pressure on the software industry in two areas: it must detect vulnerabilities earlier in the development process and, after assessing known flaws, implement effective measures to address them more quickly.<\/p>\n<h2>Why software review needs more context today<\/h2>\n<p>Applications today rarely consist of a single manageable program. They combine different programming languages, libraries, operating systems, configuration files, APIs and management interfaces. A vulnerability is therefore not always located in one line of code; it can also sit in an integration gap between several modules, in an insecure default setting or in a supply chain that is not sufficiently secured. Traditional testing methods such as static and dynamic analysis, fuzzing, code reviews, dependency checks and reproducible tests each deliver important results. Their limits lie mainly in scaling and in processing context. Large codebases produce many findings that are technically plausible yet often not exploitable in the specific application context. The real task is therefore not to &#8220;find more vulnerabilities&#8221; but to &#8220;reliably substantiate relevant findings&#8221;.<\/p>\n<h2>What powerful AI models can contribute<\/h2>\n<p>Large generative AI models can recognize relationships across files and modules, flag unusual data flows and formulate a verifiable hypothesis from a finding. In suitable test environments, they also support the creation of test cases, root cause analysis and the preparation of a patch. This is especially helpful when security knowledge, code understanding and the evaluation of Threat Intelligence must be brought together.<\/p>\n<p>However, the technology has inherent limitations. Models can overrate findings, misinterpret context or deliver convincing but non-reproducible explanations. In security-critical areas another risk comes into play: a report on a previously unknown vulnerability is itself worth protecting so that it does not fall into the wrong hands. Strict access rights, traceable logging, isolated test environments and clear rules for sharing results therefore belong in the review process itself rather than only in the response to an incident.<\/p>\n<h2>Practical example: F5 links AI analysis with product security<\/h2>\n<p>F5 shows how such an approach can look in practice, systematically using powerful AI models to review its own software. At the center is an infrastructure rather than a single model run, one that repeatedly analyzes the codebase, structures findings, checks results and forwards only confirmed problems to development. The use case is relevant for the security industry because F5 software runs at more than 80 percent of Global Fortune 500 companies, often in particularly exposed parts of the IT architecture: at the transitions between users and applications, between AI agents and APIs, and in infrastructures that control availability and access.<\/p>\n<p>Flaws in such components can have a far greater reach than an isolated problem in an internal application. Analysis, test coverage and delivery must therefore be considered together. The experience gained while building this review process yields three general lessons. First, the AI must work with real implementation context instead of evaluating only summaries or abstractions. Second, every automated finding needs verification before it reaches development as a basis for action. Third, secure handling of the results is part of product security, because a valid finding contains information about a possible attack path.<\/p>\n<h2>A robust review process consists of five stages<\/h2>\n<p>Software vendors can derive a repeatable review process from this. It combines automated analysis with strict verification and thus prevents a huge mass of unverified AI results from entering the development process.<\/p>\n<ol style=\"margin: 1.1em 0 1.4em; padding-left: 1.55em; list-style: decimal;\">\n<li style=\"margin: 0 0 0.75em;\"><strong>Establish context.<\/strong> Relevant source code areas, dependencies, configurations, build artifacts and known deployment conditions are defined. Sensitive data remains in controlled environments.<\/li>\n<li style=\"margin: 0 0 0.75em;\"><strong>Analyze.<\/strong> AI-driven static analysis searches for risky data flows, suspicious sequences, flawed authentication logic, insecure cryptography and memory safety problems.<\/li>\n<li style=\"margin: 0 0 0.75em;\"><strong>Prioritize.<\/strong> Findings are enriched with technical criteria such as exploitability, CWE mappings, severity ratings and file and line references.<\/li>\n<li style=\"margin: 0 0 0.75em;\"><strong>Verify.<\/strong> A second review path, such as a different model, a reproducible test, fuzzing or a manual analysis, separates reliable results from false alarms. A finding is considered valid only once its real-world impact can be demonstrated; it is then forwarded for prioritized remediation.<\/li>\n<li style=\"margin: 0 0 0.75em;\"><strong>Remediate and retest.<\/strong> The fix is checked in a matching test matrix, protected against regressions and assigned to a release. After delivery, an additional check verifies whether the measure is effective in the configurations actually supported.<\/li>\n<\/ol>\n<h2>Operators and customers must adjust their update cycles<\/h2>\n<p>Compared with conventional review methods, these more powerful AI-assisted analyses uncover more new vulnerabilities. At the same time, security gaps emerge ever faster as AI accelerates software development, and attackers exploit them in shorter windows as well. Because of these developments, software customers and operators must adjust their update cycles. Quarterly patches no longer suffice. Updates should happen at least monthly, and ad hoc for critical applications.<\/p>\n<p>To keep this from causing production interruptions, protection must be ensured with runtime security. More frequent fixes are no sign of poor quality. On the contrary: they demonstrate improved analysis capability and a shorter span between insight and protective action. What matters here is that the vendor transparently presents the possible impact of an exploit as well as supported versions, upgrade paths and required tests. So that patches can be applied as smoothly as possible in their own infrastructure, companies should take the following supporting measures:<\/p>\n<ul>\n<li>Keep the inventory current. Remove applications, modules, interfaces and configurations that are no longer used, and prepare deployed components for regular updates.<\/li>\n<li>Plan for updateability: also adapt processes for maintenance, rollback, high availability and testing in your own environment to frequent updates.<\/li>\n<li>Use telemetry. Continuously monitor logs and alerts that reveal exploitation or misconfiguration before a patch is available.<\/li>\n<li>Prioritize risks. Analyze which discovered vulnerability affects an exposed component, is already being exploited or enables far-reaching privilege escalation.<\/li>\n<li>Heed vendor guidance. Check the vendor&#8217;s information on each patch, test the fixes and protect security-relevant information.<\/li>\n<\/ul>\n<h2>These are the key lessons for vendors<\/h2>\n<p>Current AI models such as Claude Mythos or GPT Cyber are evolving at an enormous speed. They can now uncover real vulnerabilities, demonstrate possible exploits and help create patches. They can analyze compiled code, identify complex vulnerability chains and produce sophisticated proofs of concept. This works with source code and, in some cases, also with binaries and compiled code. For the models to support software review effectively, the following points in particular must be observed:<\/p>\n<ul>\n<li><strong>Too many false alarms overload development processes.<\/strong> AI tends to flag more potential issues rather than fewer. Investments in building verification processes, triage automation and feedback loops are therefore required. Only then are developers presented with genuine security issues and flaws that require priority fixes.<\/li>\n<li><strong>AI models keep getting faster and better.<\/strong> Each new generation of models represents a major leap in capability. Companies must therefore review their code with the latest models to keep up with attackers, who also use the latest versions.<\/li>\n<li><strong>The vulnerability reports produced must be strictly protected.<\/strong> New security gaps are an invitation for cybercriminals to attack. Corresponding reports may therefore be made available only to authorized personnel or to AI models with strict usage rights.<\/li>\n<\/ul>\n<h2>Speed needs governance<\/h2>\n<p>The threat landscape, further exacerbated by AI, calls for continuous software testing. AI itself can help examine large codebases faster and with more context. However, it delivers security value only when integrated into a controlled process: with clear access rules, independent verification, risk-based prioritization, reproducible tests and reliable update paths. For vendors of critical software, this also has practical implications for their products. Those who connect analysis, development, release management and customer communication can translate new insights into resilient protection faster. F5, for example, is currently switching from quarterly releases to more frequent updates for all of its software. For customers in turn, the ability to quickly assess and implement continuous updates is becoming a central component of their own resilience.<\/p>\n<h2>Conclusion<\/h2>\n<p>AI does not automatically make vulnerabilities manageable. Rather, it accelerates the pace at which flaws are found, assessed and potentially exploited or fixed. For providers and customers of critical applications, a continuous, smooth and traceable update process is therefore becoming ever more important.<\/p>\n<p style=\"font-style: italic; margin: 1.4em 0 2em;\"><em>Want to learn more about F5 and effective strategies against AI-based attacks? We look forward to welcoming you to our booth 7A-531 at the it-sa trade fair in Nuremberg.<\/em><\/p>\n<h2 style=\"padding-top:64px;margin-bottom:20px;\">Frequently Asked Questions<\/h2>\n<p class=\"st-faq-hint\">Every question is locked. A tap unlocks the answer.<\/p>\n<details>\n<summary><strong>Why is classic software testing no longer enough?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Applications now combine many programming languages, libraries, configurations and APIs. Static and dynamic analysis, fuzzing and code reviews hit limits of scale and context processing in large codebases. Many findings cannot be exploited in the actual application context.<\/p>\n<\/details>\n<details>\n<summary><strong>When does an AI finding count as valid?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Only when a second review path demonstrates its real impact in a traceable way. That can be another model, a reproducible test, fuzzing or a manual analysis. The finding then moves on to prioritized remediation.<\/p>\n<\/details>\n<details>\n<summary><strong>How often should operators apply patches?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">According to F5, quarterly patches are no longer enough. Updates should happen at least monthly and ad hoc for critical applications. Runtime security protects production in the meantime.<\/p>\n<\/details>\n<details>\n<summary><strong>Why do vulnerability reports need protection?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">A valid finding describes a possible attack path. Strict access rights, traceable logging, isolated test environments and clear rules for sharing results are therefore part of the review process.<\/p>\n<\/details>\n<p><!--ST-LOWER-CARDS lang=en--><\/p>\n<h3 style=\"margin:48px 0 18px;font-size:1.05em;font-weight:800;color:#e6e3da;line-height:1.2;\">Editor&#8217;s Picks<\/h3>\n<p><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/07\/04\/vulnerability-triage-cvss-alone-misguides-prioritization\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/schwachstellen-triage-cvss-allein-steuert-falsch-cover-hero-250x143.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Vulnerability Triage: CVSS Alone Misguides Prioritization<\/span><\/span><\/a><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/06\/08\/api-security-the-blind-spot-behind-every-integration\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/06\/api-security-der-blinde-fleck-hinter-jeder-integration-cover-hero-250x143.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">API Security: The Blind Spot Behind Every Integration<\/span><\/span><\/a><\/p>\n<h3 style=\"margin:48px 0 18px;font-size:1.05em;font-weight:800;color:#e6e3da;line-height:1.2;\">More from the MBF Media Network<\/h3>\n<p><a href=\"https:\/\/www.digital-chiefs.de\/en\/cra-forces-manufacturers-to-report-within-24-hours\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/11\/net-cra-forces-manufacturers-to-report-withi-39561944-250x141.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#e8828d;margin-bottom:5px;\">Digital Chiefs<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">CRA forces manufacturers to report within 24 hours<\/span><\/span><\/a><a href=\"https:\/\/mybusinessfuture.com\/en\/manufacturers-report-cra-incidents-to-enisa-before-the-csirt\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/11\/net-manufacturers-report-cra-incidents-to-en-96515700-250x141.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#aa8ac2;margin-bottom:5px;\">MyBusinessFuture<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Manufacturers Report CRA Incidents to ENISA Ahead of the CSIRT<\/span><\/span><\/a><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/06\/11\/when-ai-writes-80-of-the-code-who-checks-it\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/11\/net-when-ai-writes-80-of-the-code-who-checks-97251695.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#0bb7fd;margin-bottom:5px;\">cloudmagazin<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">When AI writes 80 per cent of code, who reviews it?<\/span><\/span><\/a><!--\/ST-LOWER-CARDS--><\/p>\n<p style=\"font-style:italic;text-align:right;font-size:0.85em;margin-top:8px;\">Image source: Getty Images \/ 1169539468<\/p>\n","protected":false},"excerpt":{"rendered":"Generative AI enables large-scale analysis of source code and, in some cases, binaries. It replaces neither secure development nor human assessment.","protected":false},"author":50,"featured_media":23833,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"vulnerability discovery","_yoast_wpseo_title":"How AI Accelerates Vulnerability Discovery in Software","_yoast_wpseo_metadesc":"Generative AI enables large-scale analysis of source code and, in some cases, binaries. It replaces neither secure development nor human assessment.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"evm_kih_original":false,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"en","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":["how-ai-accelerates-vulnerability-discovery-2"],"footnotes":""},"categories":[255],"tags":[],"class_list":["post-26640","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-praxis-umsetzung-en"],"evm_reading_time_minutes":11,"wpml_language":"en","wpml_translation_of":23834,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/26640","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/50"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=26640"}],"version-history":[{"count":12,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/26640\/revisions"}],"predecessor-version":[{"id":27250,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/26640\/revisions\/27250"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/23833"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=26640"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=26640"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=26640"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}