Well, we’ve had PHP2Shell, three important NGINX items, Plex2Shell, an eMudhra CA compromise, a GitLab vulnerability rated 10 out of 10, and LiteLLM infected by a credential stealer. And most of that was just today. It’s been quite the whirlwind for anyone working in security. Even if you’re not running PHP in production, there are probably other things you need to worry about, like your marketing website running on WordPress, or maybe your personal blog running WordPress.
It’s a little crazy because this is the first time I can remember a bunch of services preemptively going offline. BambooHR, Wikipedia, and Final Fantasy XIV, along with what I’m sure are many, many other services, just turned themselves off while trying to figure out how to deal with this PHP situation. There have been a number of large-scale security incidents. And yes, some of them have caused companies to go offline directly. But I don’t recall anyone proactively shutting down because of, say, Log4j or anything of that nature.
Some of this is clearly AI-driven. But it raises the question: Is it going to get worse or better? Or is this the new normal?
I guess I’m an optimist because I think this is just a temporary downswing before things return to the relative normalcy we had before. Attackers are adopting AI faster than defenders because they don’t need to worry about using it safely when attacking someone else. They don’t need to worry about compliance. They don’t need to worry about anything other than trying to hack someone and make some money. I think that as defenders get better at using AI and, more importantly, companies figure out how to use it to patch faster, these problems will hopefully become less common.
There’s also the question of diminishing returns. People are going to start using AI to patch vulnerabilities. And yes, as the AI models have gotten better, they’ve found more vulnerabilities. But the number of vulnerabilities in old code is limited. Even if it’s 20 years of code, AI will eventually have found every vulnerability, and we’ll have to invent new and novel approaches, which will be much rarer.
So my hope is that, on balance, software becomes more secure and we see fewer incidents caused by 20-year-old bugs. Ideally, the incidents we’re dealing with would come from genuinely new attacks, not old problems we’ve finally found.
But man, has it been tiring to try to keep up. (And yes, the blog here is patched.)
