I don't think we even have a year. The current batch of LLMs are ferociously good at identifying vulnerabilities.

Can confirm.

I work at an e-commerce agency where we work with (among others) Adobe Commerce.

The number of unauthorized RCE vulnerabilities being reported not only in the core product, but also very popular modules used in the community[1] is going through the roof.

And we are having a lot of close calls, too; just last weekend, a 0day[2] was widely being exploited at a large scale, before any publication or patch. We have learnt to be on the ball with applying patches and security updates, and even with all that effort, we saw a few projects already being hit by the initial log poisoning. We got lucky that nothing was fully compromised but I am sure that many, many webshops got infected last weekend. And not even a day later there are already other variants of this exploit showing up.

[1] https://sansec.io/research/amasty-mass-disclosure

[2] https://sansec.io/research/stylesmuggler-0day

▲

hypfer 3 hours ago | parent [-]

To be fair, ecommerce isn't exactly the branch of software where you get an oversupply of excited enthusiasts caring about the craft itself.

Probably a lot more "coding as a job" and "as a job" also implies "not my department".

So it's not necessarily the LLMs being very good, but might also "just" be that the software is very bad.

	▲	hnsr an hour ago \| parent [-]
		> To be fair, ecommerce isn't exactly the branch of software where you get an oversupply of excited enthusiasts caring about the craft itself. I want to disagree with you because I know a lot of passionate people building cool stuff, and the challenges in this space can be quite interesting. But you're probably right, and I have seen some pretty bad stuff. And a lot of the RCE's I've seen recently are quite basic stuff. I think it's the combination of low quality of code, like you said, and the relatively low cost of just letting an LLM plow through your codebases to find issues. I think the Amasty release (see [1] in GP) is a good example of this, and there really has been a massive uptick in extension updates and Adobe security bulletins since the last 1-2 months I am hoping we are just going through a catch-up phase

▲

mc3301 3 hours ago | parent | prev | next [-]

I've ran simple prompts such as "Do a in-depth sweep of this (private) repo and find any security flaws" for a few dozen long-running apps and websites that I have access to. Every single one came back with multiple real vulnerabilities within 5 or 10 minutes.

▲

dgl 3 hours ago | parent | prev | next [-]

Even if they are good the vulnerabilities have to be there. There's lots of things turning up like Local Privilege Escalations (LPE) in Linux, but serious people didn't expect the kernel to be a boundary for a sophisticated attacker.

A lot of the vulnerabilities LLMs are finding now are the "long tail" and affect only particular configurations, I would be surprised if e.g. a widely applicable RCE is found in Linux (but I'm also not going to bet against it).

Where this gets interesting is the long tail can be used to target a particular system and this is where defense-in-depth becomes important for every organisation.

▲

its-summertime 2 hours ago | parent | prev | next [-]

I guess the year mark is when things go from bad to worse? Instead of the financially motivated groups currently doing their work, it ends up being random people being able to say "Hack my ex's website" to a box they just bought and ran a program they downloaded onto it.

	▲	mcr70 a minute ago \| parent [-]
		I wish people would stop using internet for evil things. But maybe it is inevitable. Luckily, as the technology evolves, our tools and awareness are getting better at protecting us every day.

▲

Gigachad 3 hours ago | parent | prev | next [-]

Thankfully we have already made good progress towards things like arm memory tagging and memory safe languages.

It’s a rocky period right now but the future will be much more secure after all the low hanging fruit are found.

▲

jordand 2 hours ago | parent | next [-]

There's still no x86_64 processors on the market with MTE and it was only recently standardised between Intel and AMD. It's going to be 10+ years before memory tagging is widespread on desktop, and 5 years for Android/iOS devices.

▲

Cthulhu_ 3 hours ago | parent | prev | next [-]

That's definitely an improvement, but it's just one aspect of cybersecurity. Logical errors allowing people to e.g. log into services and extract data are likely everywhere still.

	▲	Gigachad 2 hours ago \| parent [-]
		If we can eliminate entire classes of bugs from being possible. It frees up resources to investigate the ones that are still possible. I suspect after a few years of LLM assisted bug hunting, everything will have a baseline security that is very good. Much like how stronger viruses simply create stronger immune systems.

▲

microtonal 3 hours ago | parent | prev [-]

How many devices/operating systems even use memory tagging? iOS, macOS and GrapheneOS, I think that's it? And iOS/macOS only use it for the kernel, a subset of system processes, and I think applications can opt in to it.

Heck, Google may have even hampered MTE in Pixel 11 (since support has been disabled) and Snapdragon 8 Gen 5 only got basic support.

We are moving way to slowly adopting hardware mitigations and memory-safe languages.

▲

jordand 2 hours ago | parent [-]

There's some positive news from the GrapheneOS devs on Pixel 11 in the past week that's worth reading up on. The MTE hardware feature is still there, they're just not sure why Google disabled it

	▲	wolvoleo 40 minutes ago \| parent [-]
		They said: > It isn't clear if there are serious CPU errata or it simply performs very badly. Meaning it's there but not terribly functional. They also said it's unreliable.

▲

mcr70 3 hours ago | parent | prev [-]

Being cautious is a good thing, but these models can also do some good. And if they run with simpler HW, it could allow all sorts of new consumer thingies. I mean, the world will not come to end in the coming year.