saved
Is this the new cyber normal?
Hraness wrote this summary from a saved copy of the source. Quotations are taken word for word from the source.
gist
Drew Silcock surveys one week of October 2026 security incidents: the PHP2Shell RCEs said to affect over 70% of the internet, eMudhra's trivially weak CA keys, decrypted Railway secrets, two CVSS 10.0 GitLab regex bugs, a musl regcomp flaw, a second LiteLLM PyPI compromise, the PingCAP leak, and Linux CVEs posted to a public list. Only some involved AI, but he argues LLMs have cut the time from rumoured bug to working exploit from weeks to hours. Closing source, AI-driven auditing, and ideal processes all fall short.
ideas
- A patch notice now starts the clock. Agents can read diffs back to the vulnerability and an exploit, so announcement day is the last safe day.
- PHP2Shell was exploited before the fix. Leaks, an exploit video, and early Chainguard fixes let attackers beat administrators within about 17 hours.
- Not every incident was AI. The GitLab and eMudhra bugs show no sign of AI discovery, though Claude reportedly recovered eMudhra keys from one prompt.
- Exploit slop does not disprove danger. Many LLM exploits fail, but one working exploit among thousands is enough.
- No remedy is clean. Closing source leaks eventually, AI audits are costly and create fix work, and perfect disclosure processes are unrealistic.
quotes
“You can have 10,000 bad slop exploits that don’t work but if there’s one that does, that’s all that matters.”
“vulnerabilities seem to come bundled with their own marketing departments now”
“Maybe we just need to accept that if you expose something to the wider internet, it will get hacked, and plan accordingly.”