The issue is where to direct the LLM's attention.

Prompting the LLM to "look for vulnerabilities in PHP's multipart upload handling code" is going to find stuff that "look for vulnerabilities in PHP" won't.

Does any one know of good feeds that we should be pulling or scraping from? I think the proactive nature here is seriously important.

Yes, so who will pay for that? Open source so far meant you would use your brains and your creativity, now you need to use your money too if you want to keep pace. From a 'guts, credits & glory' proposition to 'slop processor if you can afford it' is not really an upgrade.

Or, you know, use client certificates so the bots can’t hit you.

Those can leak / be stolen of course, but a bunch of my clients php apis survived as without a cert they’re told to fuck right off.

It does make their client onboarding a bit harder but it’s a trade off which seems to have been the right one.