PHP, TLS, etc… We appear to be facing a tsunami of vulnerabilities being discovered in record time. Further, the window to act on these vulnerabilities has basically closed to zero; hackers’ tools now automatically fold the very latest vulnerabilities into their botnets within minutes/hours of discovery. I have always been extremely reluctant to expose any of my services - even with the latest and greatest security tools. My choice to stay totally within the confines of tailscale seems vindicated given this week’s news. How are you all taking this?

https://pwn.watch/

  • Ferrous@lemmy.mlOPEnglish
    0·
    6 days ago

    Throughout 2026, IBM X-Force observed a dramatic increase in publicly disclosed vulnerabilities across major software vendors, including Microsoft, Oracle, Google Chrome and Apache. While the causes behind this increase are difficult to quantify, recent advances in AI-assisted vulnerability research demonstrate how vulnerability discovery can now occur at unprecedented scale. In August 2026, Unit 42 published a report highlighting that its autonomous vulnerability discovery platform, NOVA, identified more than 14,000 previously undiscovered vulnerabilities across nearly 4,000 open-source projects in just two months. The question is no longer whether AI can help researchers find vulnerabilities, but whether AI is changing vulnerability discovery faster than organizations are prepared to manage the risk.

    Vulnerability disclosures are up 578% in 2026 across major software vendors. Publicly disclosed CVEs across Microsoft, Oracle, Google Chrome and Apache increased from approximately 1,493 disclosures during January-September 2025 to more than 10,124 during the same period in 2026, representing roughly a 578% increase. The acceleration became most apparent in Q2 2026. Vulnerability disclosure volumes remained relatively stable through the first quarter before increasing sharply beginning in April and continuing through the summer months.

    https://www.ibm.com/think/x-force/ai-vulnerability-discovery

    Your head’s in the sand, friend.

    • tburkhol@lemmy.worldEnglish
      0·
      5 days ago

      It’s really not the publicly disclosed vulnerabilities you need to worry about. Most of those vulnerabilities have existed for years - the recent php thing is supposedly 12 years old. Maybe someone’s been out there exploiting it for 12 years.

      The people who have sought and exploited vulnerabilities since computers went online don’t disclose what they find. They are the people who should be most worried about AI-assisted vulnerability research, because it directly attacks their business model.

      • fozid@lem.radiantfig.fyiEnglish
        0·
        5 days ago

        10000% correct! I bet the NSA or KGB has had that PHP exploit for close to a decade and they are gutted its finally been patched! There are probably an infinite number of vulnerabilities in currently running servers and clients, a few 100 will already be known and being quietly exploited. Yes, ai will find some completely unknown ones for malicious actors, but it will also find those same ones for cybersec bods, so effectively cancel each other out.

        • frongt@lemmy.zipEnglish
          01·
          5 days ago

          Do security companies like cloudflare go back and look for past exploitation of vulnerabilities that were recently found by the public? I can’t think of any “we found this new vuln and turns out someone has been exploiting it for years” stories.