So what we're learning today is that in the world of LLMs, any time a serious vuln is pre-announced, social media will be flooded with incorrect or incomplete slop about it and make things worse by misleading everyone.
I hate this timeline...
0 Boosts
0 Likes
@lina like, for every entity willing to spend 5+ figures on long-running undirected searches for exploitable bugs that may or may not be out there, there are probably plenty more willing to spend 4+ figures on "this bug exists; quick, go find it"
@lina and like, "it goes back as far as PHP 5.4" is much more actionable than it used to be in limiting the search space
@rcombs And yet nobody has found it yet... what was found is incomplete, a different bug, or BS as far as we can tell.
@lina nobody has found it yet *that we know of*
I would imagine an actor motivated to spend heavily on searching for it before patch release would also be motivated not to disclose it publicly (apart from, y’know, by making use of it, and who knows if that’d have been detected yet)
once the patch *does* go out, it’ll be real interesting to see if anybody can find pre-public logs implicating it in an attack
@lina it kinda feels like even just an announcement of "there exists a bug, here is a description of its severity" is enough for a motivated attacker to throw a bunch of tokens at tracking down the bug [or at least *a* bug of the same class] before the patch drops, even if making the attempt would’ve been compute-prohibitive if they hadn’t already known there was a bug to find