Comment by dubeye
16 hours ago
I had my app running on unsupported php version for 'years', because i didn't have anyone handy to update it.
so even if it takes a few days to get my AI agent to do this, it's still a vastly more secure landscape for an amatuer like me
You should take your application offline until it’s updated. Otherwise it will be hacked immediately when this exploit comes out.
That's not likely to happen. You don't even know what the exploit is.
Anyway my point is I'm much less likely to get hacked in this new era of AI assistance, as I'm only a few days behind, rathe than a few months or years behind.
> I'm much less likely to get hacked in this new era of AI assistance, as I'm only a few days behind, rathe than a few months or years behind.
Yes, but also, attackers are much faster now and complex chains of vulnerabilities became much easier to carry out. In the past, you might have just been "secure" because nobody cared to put in the time to target you unless you were unlucky. Now, many people have the capability and can completely automatize it.
We essentially had security through obscurity for a long time. It was always dangerous. It's good that it ends. But the transition might be rough.
3 replies →
PHP core developers themselves are telling people the safest option is to take their site offline.
Security researchers expect mass attacks within 15 minutes of disclosure.
1 reply →
> Anyway my point is I'm much less likely to get hacked in this new era of AI assistance, as I'm only a few days behind, rathe than a few months or years behind.
Your agent can't help you before the patch is rolled out, so let's not lose sight that the fix to this vulnerability will be:
apt update && apt upgrade
If you didn't know how to keep your server up to date before agents, then perhaps a managed hosting service would be a better fit?
The biggest question is how is your application accessible?
Expect the entire ipv4 space to be crawled for this with common paths being attempted.
You should definitely heed their advice in this case.
The AI assistance you need is "rewrite this in something else"
It's guaranteed to happen.
what's the URL of your app?