This is shaping up to be the single worst security news day ever. Given the role that AI played in some of the discoveries, one has to wonder if this marks the start of some dark age of IT security.
Big malicious entities always had more investments in this than random open source projects.
The last few months seem to have been a lot more imunder control with also the frontier labs more warning of "what happens when Mythos-class model get in the hands of everyone" than that actually becoming reality. Now, it appears to be actuually turning into reality.
I'd say, the single worst security news day for now
It's over. Cybersecurity is now Yugioh, where the lifepoints is your token budget.
Can I get that in writing?
As we speak more slop is added to the pile, far more than can reasonably be reviewed and a lot of that code will be insecure.
It needs to be designed to be secure.
[^] of course I'm hyperbolic here, it does still need to be reviewed – I just mean, review doesn't matter as much as choosing a secure design, where certain bugs just can not or will not happen.