guys?
a graph showing the number of computer vulnerabilities by week since 1990, increasing exponentially in the last couple months.
Syndicated from the fediverse. Read and engage on the original instance.
View original on lemmy.blahaj.zoneView original on lemmy.blahaj.zone
9 replies
This shows number of discovered and publicly revealed ones.
The vulnerabiliries were mostly there already, just waiting in secret.
oh well, in that case i guess everything will be just fine. awesome!
CVEs are good. It means critical issues were found and are being fixed.
No CVEs is the more worrisome of the two.
This is just spunge bob showing up the huge pile of trash all over.
In my 30 years carrier of sw eng there was not a single company i worked for that would take security seriosly enough. Not even the two banks I worked for, the security focus was higher there, but nowhere close to enough. Deadlines had to be met, shareholders had to be made happy. Security is the type of investment the better you do it the more invisible it looks and is easy for managers to put lower on the backlog.
The ocasional security researcher I had the privilidge to talk to or work with always had few vulnerabilities in pocket to report in case they dry up on the findings.
Good luck to the overworked understuffed teams in an average company.
There's something so awesome, about a corporate security researcher keeping vulnerabilities in pocket, to have something to report.
I love the sweet, sweet irony.
Having seen the sheer volume of hallucinated or bogus reports and seeing that not every project is its own CNA...
What does the graph look like when you only count published and non-disputed CVEs? (My gut says it'll still look somewhat similar)
LLM's are fast readers with pattern matching capabilities and few inhibitions to try things out. Interesting times ahead.
It's also worth pointing out that the fact there is a new breed of exploit discovery tools itself is creating a new focus on finding and fixing security exploits.
Many (perhaps the majority?) of these were not discovered by AI agents, but were found due to extra thorough testing due to the fear of security issues being found by AI agents.
It's also important to know that some of these CVEs require super niche or unusual configuration to be exploited. This doesn't make them less valid, than elf that llms are good at is chaining exploits.
What it does do is make the defender's job significantly more difficult because how do you both stay up on all the latest vulnerabilities, but then also find valid patches without resorting to using vibe coding?