Websites taken down as critical cyber-security update issued
Discussion
Worldwide issue and will be interesting seeing where this goes.... I'm not sure if it's down to this, but I am having problems with links not being accesible on BBC website...
https://www.bbc.co.uk/news/articles/cmly0lg3w5x2o
https://www.bbc.co.uk/news/articles/cmly0lg3w5x2o
Caddyshack said:
So Ai found a problem that has never been a problem for the last 20 yrs? That says to me that Ai is a problem for security.
The issue is more that we are lagging a little behind the curve here; everyone got very excited about AI finding vulnerabilites, now in some cases they need that same compute power to work out a mitigation as well.
Caddyshack said:
So Ai found a problem that has never been a problem for the last 20 yrs? That says to me that Ai is a problem for security.
I read that the flaw has been known for a while although they didn’t think it would ever be an issue……..until they used AI to investigate and then fix it! Mmmm what could possibly go wrong?We’re all doomed!!
Caddyshack said:
So Ai found a problem that has never been a problem for the last 20 yrs? That says to me that Ai is a problem for security.
Yes, plenty of similar vulnerabilities have been spotted and patched before now. Anthropic has been giving early access to their new models to researchers and trusted professionals to run it against their codebases before it's released to the public.Only a few weeks ago I gave Claude Code the firmware to my new EV charger and it spotted that the charger was uploading log files to an FTP server using embedded username/password. I extracted the details and logged into the FTP server and could see that EVERY charger was indeed uploading to the same server and I could download anybody's charger logs! (The company took the server down the day I reported it to them)
rjfp1962 said:
Worldwide issue and will be interesting seeing where this goes.... I'm not sure if it's down to this, but I am having problems with links not being accesible on BBC website...
https://www.bbc.co.uk/news/articles/cmly0lg3w5x2o
Fascinating and important, but this?https://www.bbc.co.uk/news/articles/cmly0lg3w5x2o
BBC said:
leading bodies such as ... the BBC
Just brilliant, perfect self-aggrandisement for the arrogant dinosaur BBC.
Caddyshack said:
So Ai found a problem that has never been a problem for the last 20 yrs? That says to me that Ai is a problem for security.
It was already a problem before AI found it and this discovery was made public, AI isn't the issue.This also doesn't mean that people weren't aware prior to this particular discovery, which was made public. It also doesn't mean that the issue wasn't known about and being exploited in private.
The amount of bot traffic prodding for vulnerabilities is unreal these days, dwarfs legitimate requests by some margin. Most of it looking for the same low hanging fruit but an uptick in more targeted probing too IME.
It's probably a good thing in the long run to force these issues to be addressed, as vulnerabilities like this have been there for years and I suspect in many cases have been known by certain groups and state level actors who have kept them to themselves for use against high level targets. It's better we deal with the short term pain and get it patched then have it sitting there as an unknown. AI is good in this respect as it also helps fix the problem as well as identify it.
So far this has been very well managed by all and I'm not sure I can remember such a quick roll out of patches if my email inbox is anything to go by - it seems a fairly simple fix fortunately.
It's probably a good thing in the long run to force these issues to be addressed, as vulnerabilities like this have been there for years and I suspect in many cases have been known by certain groups and state level actors who have kept them to themselves for use against high level targets. It's better we deal with the short term pain and get it patched then have it sitting there as an unknown. AI is good in this respect as it also helps fix the problem as well as identify it.
So far this has been very well managed by all and I'm not sure I can remember such a quick roll out of patches if my email inbox is anything to go by - it seems a fairly simple fix fortunately.
130R said:
This is when you will be very happy if you have a good WAF ..
Apparently cloudflare rolled mitigation of this into their standard WAF the other day which covers a lot of ground.PHP knew about the issue for a couple of weeks before announcing the CVE - they did this on the day and said the patch was going to be available by 2pm, which it was. If you looked at the mechanism of how it worked, it needed a pretty specific combination of memory limits and file upload sizes. I'd imagine that a lot of servers will be configured to have a low file upload size so that you can't excecute the exploit (it's the default after all).
I got about 10 applications patched automatically using automations I already have in place - this is how it should be done and just a I'm a solo-developer. It's astounding to see that governments and large organisations really don't have their s
t together. CI and automated builds are the minimum, and if you're having to dick about manually patching servers then what the hell are you actually doing 
I got about 10 applications patched automatically using automations I already have in place - this is how it should be done and just a I'm a solo-developer. It's astounding to see that governments and large organisations really don't have their s
t together. CI and automated builds are the minimum, and if you're having to dick about manually patching servers then what the hell are you actually doing Probably the beginning of the end of the internet as we know it. I for one just see a load of rogue AI agents taking down companies sites and accessing systems in the not so distant future.
We need internet 2.0. Import wikipedia as a source of information and everything else needs to start from scratch. A big old NO AI ALLOWED sign on the gateway.
We need internet 2.0. Import wikipedia as a source of information and everything else needs to start from scratch. A big old NO AI ALLOWED sign on the gateway.
Gassing Station | News, Politics & Economics | Top of Page | What's New | My Stuff