There are two aspects: first that there is currently a much higher pace of critical vulnerabilities and exploits being discovered, and second that there is a much shorter window between discovery and large-scale exploitation.

People are saying the pace will settle down once LLMs find and fix all the bugs. Okay, sure, if you want to believe that sort of thing, but that still leaves the much shorter time window, and that's not going to go away anytime soon.

If you're on the side of the industry where your job or hobby involves breaking things, this is all very exciting. But if you're on the side of the industry where your job is to prevent things from being broken, then it really sucks.

I lost a full day yesterday because some big players discovered a thing, told other big players about it, "oopsed" enough public information to let everyone else know about it, and then left everyone else to figure out what to do with almost no information to act upon.

This cycle has happened several times this year now. If you're on the short list of big hosting providers, you get advance notice of what's coming and early fixes; if you're not, sucks to be you, hope you didn't have any plans today.

For people like me, this is just yet one more way LLMs are making my life materially worse.

Everything I've read indicates that yes, this is the new normal.

When Mythos was first announced, pretty much every security expert I talk to freaked directly out. A significant portion of my job now revolves around mitigating the impact of AI-generated exploits.

The rate at which we're churning out AI-generated code is going to make this worse, too, because AI-generated code is kind of notoriously terrible at security.

The security debt is temporal and going to decline because old software is going to be patched or thrown away and new one is going to be security-scanned and tested.

I'm very positive about the change. If we don't look at it purely technical, vermin from ransomware gangs and Russian/Israeli/USA spy agencies already knew a subset of these things. That shows how vulnerable we were, actually. What's a stupid bug for one, might be life and death question for another. Before, from business side of things, there was no urgency to maintain proper security and fix things, now we have a more equalized grounds and everyone has to invest both in security assessment, sandboxing/better isolation on system level and formal verification.

That will literally improve small countries and individual sovereignty against the spies and improve the humanity in the long term.

While it's a pity for many maintainers during the transition, after some time we will have much better world where you can trust your computer regardless of who you are.

I have often whined about the quality (or lack, thereof) of today's software, but I certainly have no room to be smug. I recently turned an LLM loose on a number of mature packages that I wrote, and would have sworn were "perfect," and it found issues (thankfully, none, serious, but issues, nonetheless).

I think LLMs are a gamechanger. I was just talking to a friend of mine, last night, and he pointed out that it would have been quite difficult for a human (on their own) to find the PHP2Shell issue, but he thinks that multiple LLMs probably found it (it seems that some people knew about it before it was initially "discovered").

I think that we, as programmers, need to run LLMs on our own code -no matter what we think of them, for authoring the code- and do everything we can, to batten down the hatches.

When did we start to shorten cyber security with just cyber? I see this quite often now and I think it's just stupid, it doesn't make sense.

> Maybe we just need to accept that if you expose something to the wider internet, it will get hacked, and plan accordingly. Maybe it’s our expectations that are at fault.

It's this.

It's complacency and having consciously or naively relied on security through obscurity for so long. Now that LLMs are a thing, such design flaws are trivial to expose even for the lay person, leading to a pretty massive awakening of how bad it all really was all this time, or what kind of stupid decisions have been made (i.e. the supermarket cooling incident).

I suspect the problem will solve itself though eventually, as the threat level of bad security practices has risen now, so companies have incentive to throw money at the problem for risk management, and LLMs may just as well assist with detecting potential exploits during the design phase. Thinking of it this way, I believe that security will actually improve a lot in the near future.

This is the new playing field, but this game can't last forever. Most software is not churning through a software factory of endless patches and releases. Most software, once mature, is mostly done.

I see a world in which we all get some generous Dependabot 2.0 on large forges because leaving so much software insecure otherwise is untenable, but once the software is not iterating a billion times a week, you're not introducing new classes of bugs just sitting there.

You can have a frontier security model pentesting your program every night while you sleep and you can wake up knowing that whatever happens, you did the best you could.

> already being exploited in the wild [0]

The article cites this commercial blog patting themselves on the back how they detect the exploit, yet after reading it I don't see any actual exploiting? Is scanning/probing the same as active exploitation all of a sudden?

[0]: https://ellio.tech/en/blog/php2shell-what-we-observed-and-wh...

> Who knew a regex engine was such a security issue

Anyone who has ever implemented a regex engine, I would imagine. Regex has always been a security nightmare, especially due to persistent attempts to use regexes to validate untrusted input

Meanwhile, your average enterprise app team has like a 30 day SLA for remediating critical vulns, after which they become overdue.

Unfortunately speaking from experience in AppSec

Not new normal.

It already is a thing since I believe April as I follow cybersec.

Last year May, June, July counts of sec bulbs was order of magnitude lower than this year.

But idea is that it will not last forever. New code will be vuln checked by AI as well. So now we are in transition period that is awful but it won’t last.

Security folks have understood this math for years: there have always been virtually infinite vulnerabilities in production software. Better researchers find them in any repo rather rapidly. The only thing keeping folks safe has been the limit to the research against any given repo that any highly-capable researcher would devote.

As the cost of research approaches 0 via AI tooling that approaches highly capable (and now tireless) researchers, the rate of findings will increase, as will the rate of subsequent incidents.

What remains an open question is whether in-production code quality can improve sufficiently over time to return to a state of relative security.

I'm not in a position to know. But Jason Clinton seemed to approximate "18 months" as an upper bound for the crisis period:

>as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)

https://x.com/JasonDClinton/status/2113325263157395456

Yes, but to be pedantic, no, this is a short term rise in CVEs.

This is a shift in the equilibrium of difficulty to find these exploits, but there are increased defensive tools and new awareness of these issues as important. There will be a large glut of AI detected bugs, there are decades of code surface to scan and clean up, so this will last a while.

Eventually net new software will end up being written in a more secure way, and important old software will be patched or replaced, or taken offline.

People running old versions and not applying patches rigorously is also normal. Its been normal for decades, nobody likes doing maintenance so it gets forgotten or ignored.

I can tell you, if it is, I'm going to be radically changing the software architectures and patterns that I am recommending to people.

Data privacy and security must not be sacrificed.

A shift is needed towards simplification and minimization of attack surfaces.

I've entirely removed several dependencies which provide some pretty nice features, but unfortunately make things almost unmaintainable.

I want to go much further though to simplify architectures themselves even if it makes far worse ux.

yes.

    1. Code is written, or "slopped" out.
    2. Vulns are found
    3. ...
    4. Repeat 1.

Hey, but all of us who've been complaining for years about unfixed security issues, here we go!

More like the old normal. For those who are not old enough to remember 25+ years ago, we used to have weekly stories about worms etc. and companies often ignored vulnerability reports. It was a wild time, and in many ways we are better prepared to deal with it today than we were back then.

> Two different security teams, one from California security company Calif (as part of OpenAI’s “Patch the Planet” program) and another from Israeli-U.S. cloud security company Wiz (they’re part of Google Cloud, apparently), both found these two Remote Code Execution (RCE) bugs in PHP.

Am I the only surprised that Google and OpenAI do not care to allow time to patch this before releasing it in the wild?

Missing from the article: Node2Shell https://www.imperva.com/blog/node2shell-from-brotli-data-to-...

I can't help but wonder if we're going to see the OS and browser maintainers begin streamlining code and reducing complexity. Software these days almost seems like a fractal of insecurity, the only way to make the problem more tractable is to reduce attack surface.

Is this the new normal, or just, uh, normal?

Big embarrassing network-exploitable bugs in major open-source projects happen sometimes, and network-scanning attack botnets have been around forever. Small shady CAs mess things up sometimes. People upload malware to PyPI and NPM all the time, and "move fast and break things" software-deployment startups get breached all the time, to the point where it doesn't even really feel like news to me when those things happen again.

It's unfortunate that a few of those events all happened at around the same time. But, like, even if that's not a coincidence and these events are actually happening more frequently, you should have been preparing for them anyway!

Yes, the PHP risks have been known, and partly assumed. I watched a group from MIT ignore sage advice on avoiding PHP but built their administration interface with it anyways. Now this device is deployed in heavy industry, in mining, in transportation, in healthcare, it's deployed everywhere and in multiple continents and in multiple huge cities. It's concerning that the recommendations we made were eshewed and they went ahead with this anyways and now we are in this situation. This group from MIT had formed a company, and they were bought by a large network device manufacturer. It's deeply deeply concerning.

This situation is temporary.

It is obviously true that there can only be a finite number of serious security bugs in any given software. For a given level of LLM capability, there is a finite subset of these bugs that is actually discoverable and exploitable. Once this finite subset is exhausted, the tide of new vulnerabilities will stop.

Perhaps we will see a few more tides like this, as LLM capabilities advance further. But there will be an end.

For now yes. When LLMs can iterate and test at speeds humans cannot, it is going to continue to find holes.

An interesting side effect will be whether we accelerate moving towards memory safe languages (and development of more of those languages) in more sectors than just 'low-level'.

Not forgetting that this is only one mitigation of cyber-attacks and exploits and potentially removes a whole category of attacks developed by analyzing *source code*

It really depends on your gut feeling about how deep the rabbit holes in terms of number of game changer vulnerabilities.

How many RCEs are in PHP of this kind? Many people would've said zero before. After the fixes, it may be zero again. It could be thousands, it could be eighty-six, it could be four, it could be zero. But even if you don't think it's zero again, most people will find themselves that there's probably not many left.

Extend this to other world ecosystem - how many high impact devastating security bugs are there? Dozens, hundreds, thousands, millions? At least when it comes to open source security, there has to be some low upper bound given how countable the number of projects there are where impact could be high and most have taken some care for their quality (despite obvious hardships). And while closed source software is harder to reason about (also on the ecosystem level), if there's a low upper bound for open source software surely the bound for closed source software can't be many orders of magnitude higher.

We now have new tools that allows us to discover these. Both the discovery as well as changes in the development process most are taken should bring these numbers closer to zero again. The main question is - are we working through a small backlog of issues, or a very deep one with no practical end? I'm still inclined to believe it's a manageable backlog, but I'm an optimist and everybody's intuitions differ on this.

No. This is just the start. It's going to get way worse before it gets better.

It’s mostly hype. Days in now and nobody can exploit the PHP vuln. Yawn.

What confuses me the most is that nobody talks about the nature on how to exploit this vulnerability.

This has been a well known vulnerability for years but considered too complicated to exploit. It is the type of work that would have taken an expert weeks to hack into a single system and the idea that an AI can speed this is up is not unfounded but currently without evidence.

Yes, the attack surface is huge but when compared to Log4J this is materially more difficult to execute and the countless PoC that have been seen were AI slop.

As a security expert I see why you would not want to downplay this, but I think the involved actors have all the incentive to use this for their typical messaging.

As a tech community we have a greater responsibility to not be driven by hype but understand what is going on and let make ourselves some tools and be swayed by the messaging and instead talk about this in a more nuanced way. Perhaps I am wrong because I am not a cyber person myself but this all strikes me as similar to the whole Specter outrage.

These are all human-generated software bugs. At some point when AI writes all code, the bugs should all but disappear. Almost.

> Makes a few very wealthy tech CEOs very happy.

why is this both pros and cons?

Somewhat. I take heart in the fact that people actually took the "website down now" messaging seriously and that there was a quick patch to address the issue. It'll still be an arms race between red team and blue team, just faster paced.

By generating the entire website in AI, yes, you are contributing to the new normal

That's new Poisson

> Is this the new cyber normal?

No. We're in a "brief" [0] transition period where a scaleable superhuman developer enters the scene and discovers a whole heap of bugs. Once the majority of code is written by similar systems then the tide of critical bugs being found will slow down.

The article does sorta say this but lets not bury the lede to deeply. It isn't realistic to expect new security vulnerabilities to be found at this rate, we're clearing out years of backlog and the maintainers haven't had time to deploy AI to do the software right the first time. Once the situation stabilises I'd personally expect very few public vulnerabilities because the expertise in how to assess code security is moving from a handful of experts to everyone.

> The NHS approach: close source everything.

Yeah good luck. I've seen how these systems work at decompiling and I expect they're probably going to be really good at fuzzing too.

[0] Could take a while.

> Even though this was found by “responsible security researchers” at “respectable companies”, by the time the security patch actually got released, it was already being exploited in the wild.

I am really not pleased with the "let's delay" strategy. IMO, you should without any delay, let everyone know of security-related issues. This "try to keep it hidden so that malicious actors can not exploit" is incredibly unfair to everyone else. Why would I want to support that? I want to know the exploit, I want it explained and then, in that order, I also expect that it can be fixed eventually. This closed-source thinking is very annoying. If one LLM can find an exploit, so can others, so what's with the delay?

I'm a bit of an AI doomer but I'm going to disagree. I don't think this is the new mormal but there is going to be a dark transitional period.

What we're seeing is a bit of a "gold rush" where LLm advancements are coming thick and fast and they're being pointed out code bases that simply haven't had the level of scrutiny where relatively easy bugs to find have managed to survive. That's temporary. Here are my predictions:

1. Correctness and, in particular, memory safety is going to become increasingly important. I was bullish on Rust before this AI hype wave. LLMs finding and exploiting bugs has reinforced just important it is that Rust prevents as certain class of bugs that are the most prone to rmote exploitation ie certain memory safety issues.

I've long said that modern CPU architectures, out-of-order execution, hyperthreading (does that still exist? or did Intel fully kill it?), different CPU cores and compiler optimizations that it is essentially impossible for a human to write correct multithreaded code, particularly in userspace with "leaf node" code. LLMs just make that more apparent; and

2. Mature code bases for core functionality are going to become increasingly important because they've been "proven" in the wild (as much as you can prove a negative).

My sincerest hope, which is probably more wishful thinking than anything else, is that LLMs will be another nail in the coffin for C++, which is simply too complex and dragged down with legacy features and backwards compatibility to be salvageable.

> At the time of writing (23rd Oct), eMudhra has announced that it will be retiring from the certificate authority space. In unrelated news, a farmer has announced that he has shut his stable door, following reports of an escaped horse.

Ah, wit is alive and strong!

LLMs seem to be very good at detecting vulnerabilities caused by using C and other forms of human stupidity.

So yes.

Not for me. I’m taking my shit offline. Out of harms way.

Am I the only one that hates seeing "cyber" when refering to cybersecurity?

The same with "crypto" to refer to cryptocoins instead of cryptography.

It will be until we (hopefully) change the way we work.

Security has been an afterthought for most of the past 30-40 years, and there are virtually no regulations requiring security, audits, or inspections before releasing software.

Now that attacks are cheap and easy, the only way to prevent these constant compromises will be to secure things before releasing them - not an afterthought, but a prerequisite. If we do finally as a society demand this, then the compromises will go away, because we won't release any new versions of software without securing it first.

This depends on having open weights with strong security scanning. If nations keep banning powerful open weight models "because they're dangerous", those nations' companies will be at more risk, because they won't have the tools to secure their own software. Countries with more permissive models will allow their own businesses to secure their stacks earlier, more people will use those businesses, they will thrive. The invisible hand of the market will choose whoever can improve first, not whoever bans things first.

I hope not. A lot of LLM assisted vulnerability stuff has been noise, slop, fluff, or fake/false data. Drowns out the real issues.