Comment by dubeye
17 hours ago
That's not likely to happen. You don't even know what the exploit is.
Anyway my point is I'm much less likely to get hacked in this new era of AI assistance, as I'm only a few days behind, rathe than a few months or years behind.
> I'm much less likely to get hacked in this new era of AI assistance, as I'm only a few days behind, rathe than a few months or years behind.
Yes, but also, attackers are much faster now and complex chains of vulnerabilities became much easier to carry out. In the past, you might have just been "secure" because nobody cared to put in the time to target you unless you were unlucky. Now, many people have the capability and can completely automatize it.
We essentially had security through obscurity for a long time. It was always dangerous. It's good that it ends. But the transition might be rough.
That's an interesting theory I wonder if there is much evidence to back it up.
I'm not seeing reports of dramatic increase in hacks.
It will be interesting test case today, will we see huge amounts of hacks or not.
True, it's a theory; basically a hypothesis derived from my experience with LLMs and their performance in CTFs/finding and exploiting vulnerabilities. Plausible, I believe, but I don't have any hard evidence of it happening.
Maybe the effort and required hardware of running an LLM locally have so far prevented widespread exploitation? Maybe open-weight LLMs are too far behind at the moment? Maybe it's happening but we didn't notice it for some reason?
I would strongly assume that it will happen at some point if it isn't already.
1 reply →
PHP core developers themselves are telling people the safest option is to take their site offline.
Security researchers expect mass attacks within 15 minutes of disclosure.
safest option no doubt, let's see what percentage of unpatched websites are hacked today.
> Anyway my point is I'm much less likely to get hacked in this new era of AI assistance, as I'm only a few days behind, rathe than a few months or years behind.
Your agent can't help you before the patch is rolled out, so let's not lose sight that the fix to this vulnerability will be:
apt update && apt upgrade
If you didn't know how to keep your server up to date before agents, then perhaps a managed hosting service would be a better fit?
The biggest question is how is your application accessible?
Expect the entire ipv4 space to be crawled for this with common paths being attempted.
You should definitely heed their advice in this case.
The AI assistance you need is "rewrite this in something else"
It's guaranteed to happen.
what's the URL of your app?