<![CDATA[There's serious panic being caused by AI discovered vulnerabilities behind the scenes, where those finding them are basically using them as marketing.]]>There's serious panic being caused by AI discovered vulnerabilities behind the scenes, where those finding them are basically using them as marketing. Automated vulnerability hype train again, basically.

A thread on a few of them.

]]>https://board.circlewithadot.net/topic/4955da9a-5e35-4905-a747-0f074a5ef9fe/there-s-serious-panic-being-caused-by-ai-discovered-vulnerabilities-behind-the-scenes-where-those-finding-them-are-basically-using-them-as-marketing.RSS for NodeFri, 15 May 2026 02:51:19 GMTThu, 14 May 2026 11:09:40 GMT60<![CDATA[Reply to There's serious panic being caused by AI discovered vulnerabilities behind the scenes, where those finding them are basically using them as marketing. on Thu, 14 May 2026 11:32:19 GMT]]>@GossiTheDog ... also never turn off ASLR! Why would someone do that nowadays!?

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/draeath/statuses/116572706541044488https://board.circlewithadot.net/post/https://infosec.exchange/users/draeath/statuses/116572706541044488Thu, 14 May 2026 11:32:19 GMT<![CDATA[Reply to There's serious panic being caused by AI discovered vulnerabilities behind the scenes, where those finding them are basically using them as marketing. on Thu, 14 May 2026 11:27:30 GMT]]>@GossiTheDog and that's why I'm here. Thanx for keeping us calm.

]]>https://board.circlewithadot.net/post/https://cyberplace.social/users/fatalisticcritic/statuses/116572687574926373https://board.circlewithadot.net/post/https://cyberplace.social/users/fatalisticcritic/statuses/116572687574926373Thu, 14 May 2026 11:27:30 GMT<![CDATA[Reply to There's serious panic being caused by AI discovered vulnerabilities behind the scenes, where those finding them are basically using them as marketing. on Thu, 14 May 2026 11:25:41 GMT]]>@GossiTheDog but but but, how else am I supposed to market magic box triage-as-a-service

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/nyanbinary/statuses/116572680434284973https://board.circlewithadot.net/post/https://infosec.exchange/users/nyanbinary/statuses/116572680434284973Thu, 14 May 2026 11:25:41 GMT<![CDATA[Reply to There's serious panic being caused by AI discovered vulnerabilities behind the scenes, where those finding them are basically using them as marketing. on Thu, 14 May 2026 11:25:29 GMT]]>@GossiTheDog I'd be willing to bet that if they paid real humans the same amount of money as the true cost of running the LLM, they'd find more and better bugs.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/womble/statuses/116572679678651080https://board.circlewithadot.net/post/https://infosec.exchange/users/womble/statuses/116572679678651080Thu, 14 May 2026 11:25:29 GMT<![CDATA[Reply to There's serious panic being caused by AI discovered vulnerabilities behind the scenes, where those finding them are basically using them as marketing. on Thu, 14 May 2026 11:24:29 GMT]]>I will likely be one of the first people banging the drum to patch and mitigate if any of the recent AI vulns results in serious harm. Otherwise, keep calm and carry on patching as usual.

]]>https://board.circlewithadot.net/post/https://cyberplace.social/users/GossiTheDog/statuses/116572675730952599https://board.circlewithadot.net/post/https://cyberplace.social/users/GossiTheDog/statuses/116572675730952599Thu, 14 May 2026 11:24:29 GMT<![CDATA[Reply to There's serious panic being caused by AI discovered vulnerabilities behind the scenes, where those finding them are basically using them as marketing. on Thu, 14 May 2026 11:22:40 GMT]]>@GossiTheDog I already feel so "boy who cried wolf"ed about all the vulns

]]>https://board.circlewithadot.net/post/https://meow.social/users/robinsyl/statuses/116572668576024730https://board.circlewithadot.net/post/https://meow.social/users/robinsyl/statuses/116572668576024730Thu, 14 May 2026 11:22:40 GMT<![CDATA[Reply to There's serious panic being caused by AI discovered vulnerabilities behind the scenes, where those finding them are basically using them as marketing. on Thu, 14 May 2026 11:20:46 GMT]]>@0xtero @GossiTheDog Meanwhile

1. AI coding agents are one of the factors contributing to shorter intervals between “vulnerability discovery” and “working exploit”

2. Orgs can’t be bothered to patch known vulnerabilities in a timely fashion so a huge proportion of cyberattacks and their associated damage are down to bugs that have been known about (and left unpatched) for half a year or more

]]>https://board.circlewithadot.net/post/https://twit.social/users/MisuseCase/statuses/116572661097233110https://board.circlewithadot.net/post/https://twit.social/users/MisuseCase/statuses/116572661097233110Thu, 14 May 2026 11:20:46 GMT<![CDATA[Reply to There's serious panic being caused by AI discovered vulnerabilities behind the scenes, where those finding them are basically using them as marketing. on Thu, 14 May 2026 11:19:44 GMT]]>@GossiTheDog
(except fewer)

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116572657032151193https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116572657032151193Thu, 14 May 2026 11:19:44 GMT<![CDATA[Reply to There's serious panic being caused by AI discovered vulnerabilities behind the scenes, where those finding them are basically using them as marketing. on Thu, 14 May 2026 11:19:32 GMT]]>@GossiTheDog while they can certainly find some fun things, a number of the "vulns" are ridiculous "Oh this can be an RCE during full moons with ASLR disabled running on TRSDOS ported to ARM."

The models don't really threat model well at all. I like @bagder 's approach of VULN-DISCLOSURE-POLICY.md

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/mikesiegel/statuses/116572656293225699https://board.circlewithadot.net/post/https://infosec.exchange/users/mikesiegel/statuses/116572656293225699Thu, 14 May 2026 11:19:32 GMT<![CDATA[Reply to There's serious panic being caused by AI discovered vulnerabilities behind the scenes, where those finding them are basically using them as marketing. on Thu, 14 May 2026 11:17:16 GMT]]>@MisuseCase @GossiTheDog most of the stuff is just pure marketing fluff. Sure, AI is finding bugs. People are fixing them. This has been the case for a while now. Nothing new. Exploitable bugs still very rare. Catastrophic ones like Heartbleed nil, so far. It’s business as usual. The noise volume is up, quality of the signal seems about same as always.

]]>https://board.circlewithadot.net/post/https://ohai.social/users/0xtero/statuses/116572647330864912https://board.circlewithadot.net/post/https://ohai.social/users/0xtero/statuses/116572647330864912Thu, 14 May 2026 11:17:16 GMT<![CDATA[Reply to There's serious panic being caused by AI discovered vulnerabilities behind the scenes, where those finding them are basically using them as marketing. on Thu, 14 May 2026 11:16:24 GMT]]>CVE-2026-42945 - Nginx (otherwise branded Nginx Rift)

It relies on a specific Nginx config to be vulnerable, and for attacker to know or discover the config to exploit it. To reach RCE, also ASLR needs to have been disabled on the box.

The PoC they've built specifically disabled ASLR, deploys a specifically vulnerable config and the exploit knows about the vulnerable config endpoint.

Link Preview ImageLink Preview Image
]]>https://board.circlewithadot.net/post/https://cyberplace.social/users/GossiTheDog/statuses/116572643931253811https://board.circlewithadot.net/post/https://cyberplace.social/users/GossiTheDog/statuses/116572643931253811Thu, 14 May 2026 11:16:24 GMT<![CDATA[Reply to There's serious panic being caused by AI discovered vulnerabilities behind the scenes, where those finding them are basically using them as marketing. on Thu, 14 May 2026 11:11:19 GMT]]>@GossiTheDog I really want to hear your take on this because I’ve heard conflicting things about whether any of the vulnerabilities are serious or not.

]]>https://board.circlewithadot.net/post/https://twit.social/users/MisuseCase/statuses/116572623949148512https://board.circlewithadot.net/post/https://twit.social/users/MisuseCase/statuses/116572623949148512Thu, 14 May 2026 11:11:19 GMT<![CDATA[Reply to There's serious panic being caused by AI discovered vulnerabilities behind the scenes, where those finding them are basically using them as marketing. on Thu, 14 May 2026 11:11:16 GMT]]>CVE-2026-34486 - Tomcat

- Only exploitable if a certain feature is used, if its endpoint is reachable and if port 4000 is available. It's pretty niche.

]]>https://board.circlewithadot.net/post/https://cyberplace.social/users/GossiTheDog/statuses/116572623784727448https://board.circlewithadot.net/post/https://cyberplace.social/users/GossiTheDog/statuses/116572623784727448Thu, 14 May 2026 11:11:16 GMT