Press Space to continue
It should have been the best-case scenario
Press Space to continue
Former DOE security engineer @asynchronous_x explains how a miscommunication turned a planned PHP2Shell fix into a race against hackers: "It should have been the best-case scenario. Security researchers identified these vulnerabilities, developed proof of concept exploits in advance, and were informing the PHP core team for fixes. That whole part was working fine." "The reason this one’s unique is there was basically a leak of the vulnerability before the disclosure. That was supposed to be…
OpenAI@OpenAI3d ago
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors. Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact. This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare. https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
View