Post

Uncle Joe
@sydseter.com

Zero-days are not really zero-days. First of all, no APT or script kiddy develop exploits for vulnerabilities that hasn’t been published. During the PHP2Shell incident, nobody was able to do a workable exploit using AI or otherwise faster than you could patch. #security

2 reposts3 likes

Lea Viljanen
@ladybugfi.bsky.social

Script kiddies right, but I disagree on #APT. Nowadays it's relatively easy to put #AI engines to search for unpublished #vulnerability if you have access to binaries or source code. I bet state-backed units worldwide are at it right now. Obvs the #exploit isn't published until needed. #security

Uncle Joe
@sydseter.com

Stuxnet was built jointly by US and Israel in a collaborative effort for several years and was used specifically for targeting nuclear industrial complexes. You still need really specialized skills to weaponize these. Is not that you can point your AI models at the code and develop malware in 3 days

Uncle Joe
@sydseter.com

Most exploits published where all untested, non-working, AI slope. The few working exploits were from highly skilled individuals and they only worked on a sub-set of PHP configurations under very specific conditions. As long as you auto-patch when the he patch comes out, you are safe.

Uncle Joe
@sydseter.com

No reason to get up at night or worry about Mythos. Mythos is mythos and it’s still business as usual as far as patching is concerned, and ai makes no difference. It still takes real skills to develop workable malware.

Uncle Joe
@sydseter.com

If you want to use AI where it really pays off, instead of spending large amount of resources on scanning all your source code using the latest AI models, use it to automatically patch your software. Then wait 24 hours and test it before deployment ofcourse.