The good news is, if you emergency patched your Debian for php2shell, you probably got the new kernel on the same apt run. This time the embargo actually held, and the new kernel was out before the CVE came public
If AI is building all the systems and writing all the code, and AI is finding bugs and exploits in existing code and code being generated by AI... With the assumption that any code base scanned in its entirety by the latest frontier cybersecurity focused models is secure... This assumption only holds until a more advanced model is created to find bugs and exploits in the code from the now lesser advanced model... Which means even the code the top of the line model just created was never really secure...
How does this cycle get broken?? Will people ever be able to be sold the (false idea) that their devices are secure?
The good news is, if you emergency patched your Debian for php2shell, you probably got the new kernel on the same apt run. This time the embargo actually held, and the new kernel was out before the CVE came public
The only way to survive is to just update everything daily or faster.
At work we currently have a weekly release schedule but im going to push to speed it up because 1 week is far too long to leave packages out of date.
Then you get exposed to a supply chain attack.
Supply chain attacks through distro repos haven’t really been a thing.
Random npm packages are another thing.
We got very close in XZ Utils.
https://en.wikipedia.org/wiki/XZ_Utils_backdoor
If AI is building all the systems and writing all the code, and AI is finding bugs and exploits in existing code and code being generated by AI... With the assumption that any code base scanned in its entirety by the latest frontier cybersecurity focused models is secure... This assumption only holds until a more advanced model is created to find bugs and exploits in the code from the now lesser advanced model... Which means even the code the top of the line model just created was never really secure...
How does this cycle get broken?? Will people ever be able to be sold the (false idea) that their devices are secure?
The implications are extensive.
> With the assumption that any code base scanned in its entirety by the latest frontier cybersecurity focused models is secure...
The models that many organisations and most individuals don't have access to?
Nope. This was just the start.