You should take your application offline until it’s updated. Otherwise it will be hacked immediately when this exploit comes out.
Anyway my point is I'm much less likely to get hacked in this new era of AI assistance, as I'm only a few days behind, rathe than a few months or years behind.
Security researchers expect mass attacks within 15 minutes of disclosure.
Yes, but also, attackers are much faster now and complex chains of vulnerabilities became much easier to carry out. In the past, you might have just been "secure" because nobody cared to put in the time to target you unless you were unlucky. Now, many people have the capability and can completely automatize it.
We essentially had security through obscurity for a long time. It was always dangerous. It's good that it ends. But the transition might be rough.
I'm not seeing reports of dramatic increase in hacks.
It will be interesting test case today, will we see huge amounts of hacks or not.
Maybe the effort and required hardware of running an LLM locally have so far prevented widespread exploitation? Maybe open-weight LLMs are too far behind at the moment? Maybe it's happening but we didn't notice it for some reason?
I would strongly assume that it will happen at some point if it isn't already.
in my experience AI is helping me defend against potential vulnerabilities, and so the net impact of these threats is net zero or less, even if I'm quite slow in patching stuff
The AI assistance you need is "rewrite this in something else"
Expect the entire ipv4 space to be crawled for this with common paths being attempted.
Your agent can't help you before the patch is rolled out, so let's not lose sight that the fix to this vulnerability will be:
apt update && apt upgrade
If you didn't know how to keep your server up to date before agents, then perhaps a managed hosting service would be a better fit?