The flaw was in at least 20 year old code, which seems to be a common theme for AI discoveries.

No compute costs for finding the issue or for writing the exploit are disclosed.

But it is marketed as if it were the first RCE found in human history.

nope1000 4 hours ago | parent | next [-]

I like to be AI sceptical as well but I think it's even more noticeable if the flaw is in 20 year old code which thousands of people have read and reviewed and not noticed, isn't it?

▲

ashfg1 4 hours ago | parent | next [-]

Hardly anyone reads and reviews in open source. It is a myth from ESR. Probably one person wrote it and another one said LGTM.

	▲	bitwize 4 hours ago \| parent [-]
		Today ESR would say "All bugs are really shallow this time, thanks to our robot friends!"

▲

pizzafeelsright 4 hours ago | parent | prev [-]

The recent signed keys being '4' is an example.

Looks good, validates, works, and then trust is assumed.

▲

basilikum 3 hours ago | parent [-]

Private keys are not exactly open source. I mean in this case they kinda were, which is why they were found, but the point stands.

	▲	pizzafeelsright an hour ago \| parent [-]
		It was assumed the private keys were private, not easily figureoutable, so they were most likely never tested.

▲

pizzafeelsright 4 hours ago | parent | prev | next [-]

I discovered a large security concern that has existed for a decade, since the code was originally written. I was working on an unrelated task when my AI agent discovered an oversight because the agent happen to examine that file.

Everything was sound and every test passed for years along with every security scan because intent was not validated.

I would expect an unending source of exploits in the future until AI rewrites everything.

	▲	zdragnar 3 hours ago \| parent [-]
		AI writing the code doesn't make it safer. It is prone to making all the same mistakes humans do. AI reviewing the code does help, though.

▲

pixl97 4 hours ago | parent | prev | next [-]

Eh, it's an RCE that's been around forever and runs on a pretty large number of websites. Worse a lot of businesses have things like wordpress sites so one of those getting compromised is a foot in the door allowing movement into the more protected areas of the network.

So yea, it's a big deal.

▲

zelphirkalt an hour ago | parent | next [-]

Personally, I am looking forward to any rich-enough companies, that make horrific WP websites and call it a day, rather than actually caring what they force upon people, to have their websites defaced. I have long held the opinion, that you can't really make an actually professional website, that is anything more than a blog, based on WP.

It just has so many flaws, that it will always be shitty in some way or another. For an actual business of say > 5 people, it will be worth using other technology to make their web presence.

There will always be something some of the following:

(1) You have 20 plugins to manage and update things often, and still have vulnerabilities and exploits going on with your site.

(2) Your theme is shitty and not actually responsive, because it is built upon a trash pile of bad styling and badly thought out WP theme structure which relies on concatenation rather than composition of parts.

(3) The database is a mess, because you need to shoehorn things into WP's very limiting DB design of posts and pages being the primitives to think in terms of.

(4) The site is super sluggish. Then self-taught "WP specialist" comes and "saves the day" by installing yet another caching plugin, adding even more attack surface. And now your site relies on yet a badly written cache plugin.

(5) WP itself will break your code and also break your data protection, by having updates, that include third-party fonts to misuse fonts, to render unicode characters that you used as friggin icon characters from that third party font. (no joke, this happened)

So you really cannot win this battle and your site will simply not be a site, that I would consider actually professionally made. The whole WP ecosystem is too broken, to allow you to succeed. You would have to go against many of its common practices and if you do that, you don't actually benefit from that ecosystem and can simply use another language and another web framework, that doesn't suck so much for creating web platforms.

WP is for quick blogging. Don't use it for other stuff.

▲

SoftTalker 4 hours ago | parent | prev [-]

Web servers should not be a foot in the door. They should be assumed hostile and stringently limited. PHP especially has been notorious for remotely exploitable bugs but that's probably more due to its popularity and wide use by beginners than it being strictly worse than any other stack in this regard.

	▲	pixl97 3 hours ago \| parent \| next [-]
		>Web servers should not be a foot in the door. shoobe < doobe PHP was a component in the LAMP stack which was known to be 'free' and easy to setup for new users at the time as you say. That builds an ecosystem. Ecosystems are very hard to move away from, especially when your users are not highly technical. Security is almost always a second or third rate consideration for this type of user. If you look at most applications configured in the enterprise, or practically any Microsoft web based application, they are not strongly security configured against write access to the machine.
	▲	trollbridge 3 hours ago \| parent \| prev [-]
		I treat my PHP servers like they're a hostile entity, going so far as to put them on their own VLANs, turning off optimisations for virtualisations to avoid container escaping, and so forth. It's a strategy that has so far paid off quite well. Thankfully in the era of AI it is gettig quite easy to refactor PHP into something else.

▲

zoeysmithe 4 hours ago | parent | prev | next [-]

php RCE's are a big deal. So much of public facing stuff is drupal or wordpress and heaven knows all the places php is being used. Think embedded systems and appliances and in turn-key software.

I don't know why php is impossible to harden, but its a security minefield, and if there is an RCE then its trivial to attack because so many of these systems are public facing. I veto any php based applications just over this.

▲

chrisvenum 4 hours ago | parent | prev [-]

[dead]