zhashtoshi_ on Nostr: This week was a preview of the new normal: AI found two critical PHP flaws, ...

This week was a preview of the new normal: AI found two critical PHP flaws, government sites went offline while admins patched, and LiteLLM got backdoored on the same day.

Finding bugs is no longer the bottleneck. Since April, models have been digging up flaws that sat unnoticed for decades in heavily audited code. The slow part is now everything after: triage, a fix, a release, and someone actually installing it.

So the boring stuff matters more than ever:
- know what you run (and which versions)
- make updating cheap, so you do it the same day
- fewer dependencies, pinned, from sources you check
- assume the window between disclosure and exploit is hours, not weeks

The attackers got the same tools. Whoever patches faster wins.