upvote
Can confirm.

I work at an e-commerce agency where we work with (among others) Adobe Commerce.

The number of unauthorized RCE vulnerabilities being reported not only in the core product, but also very popular modules used in the community[1] is going through the roof.

And we are having a lot of close calls, too; just last weekend, a 0day[2] was widely being exploited at a large scale, before any publication or patch. We have learnt to be on the ball with applying patches and security updates, and even with all that effort, we saw a few projects already being hit by the initial log poisoning. We got lucky that nothing was fully compromised but I am sure that many, many webshops got infected last weekend. And not even a day later there are already other variants of this exploit showing up.

[1] https://sansec.io/research/amasty-mass-disclosure

[2] https://sansec.io/research/stylesmuggler-0day

reply
To be fair, ecommerce isn't exactly the branch of software where you get an oversupply of excited enthusiasts caring about the craft itself.

Probably a lot more "coding as a job" and "as a job" also implies "not my department".

So it's not necessarily the LLMs being very good, but might also "just" be that the software is very bad.

reply
> To be fair, ecommerce isn't exactly the branch of software where you get an oversupply of excited enthusiasts caring about the craft itself.

I want to disagree with you because I know a lot of passionate people building cool stuff, and the challenges in this space can be quite interesting. But you're probably right, and I have seen some pretty bad stuff. And a lot of the RCE's I've seen recently are quite basic stuff.

I think it's the combination of low quality of code, like you said, and the relatively low cost of just letting an LLM plow through your codebases to find issues. I think the Amasty release (see [1] in GP) is a good example of this, and there really has been a massive uptick in extension updates and Adobe security bulletins since the last 1-2 months

I am hoping we are just going through a catch-up phase

reply
Even if they are good the vulnerabilities have to be there. There's lots of things turning up like Local Privilege Escalations (LPE) in Linux, but serious people didn't expect the kernel to be a boundary for a sophisticated attacker.

A lot of the vulnerabilities LLMs are finding now are the "long tail" and affect only particular configurations, I would be surprised if e.g. a widely applicable RCE is found in Linux (but I'm also not going to bet against it).

Where this gets interesting is the long tail can be used to target a particular system and this is where defense-in-depth becomes important for every organisation.

reply
> but serious people didn't expect the kernel to be a boundary for a sophisticated attacker.

I think it has more to do with what's on each side of the boundary in practice, a la https://xkcd.com/1200/ .

reply
I've ran simple prompts such as "Do a in-depth sweep of this (private) repo and find any security flaws" for a few dozen long-running apps and websites that I have access to. Every single one came back with multiple real vulnerabilities within 5 or 10 minutes.
reply
Thankfully we have already made good progress towards things like arm memory tagging and memory safe languages.

It’s a rocky period right now but the future will be much more secure after all the low hanging fruit are found.

reply
That's definitely an improvement, but it's just one aspect of cybersecurity. Logical errors allowing people to e.g. log into services and extract data are likely everywhere still.
reply
If we can eliminate entire classes of bugs from being possible. It frees up resources to investigate the ones that are still possible.

I suspect after a few years of LLM assisted bug hunting, everything will have a baseline security that is very good. Much like how stronger viruses simply create stronger immune systems.

reply
There's still no x86_64 processors on the market with MTE and it was only recently standardised between Intel and AMD. It's going to be 10+ years before memory tagging is widespread on desktop, and 5 years for Android/iOS devices.
reply
How many devices/operating systems even use memory tagging? iOS, macOS and GrapheneOS, I think that's it? And iOS/macOS only use it for the kernel, a subset of system processes, and I think applications can opt in to it.

Heck, Google may have even hampered MTE in Pixel 11 (since support has been disabled) and Snapdragon 8 Gen 5 only got basic support.

We are moving way to slowly adopting hardware mitigations and memory-safe languages.

reply
There's some positive news from the GrapheneOS devs on Pixel 11 in the past week that's worth reading up on. The MTE hardware feature is still there, they're just not sure why Google disabled it
reply
They said:

> It isn't clear if there are serious CPU errata or it simply performs very badly.

Meaning it's there but not terribly functional. They also said it's unreliable.

reply
I guess the year mark is when things go from bad to worse? Instead of the financially motivated groups currently doing their work, it ends up being random people being able to say "Hack my ex's website" to a box they just bought and ran a program they downloaded onto it.
reply
I wish people would stop using internet for evil things. But maybe it is inevitable. Luckily, as the technology evolves, our tools and awareness are getting better at protecting us every day.
reply
Being cautious is a good thing, but these models can also do some good. And if they run with simpler HW, it could allow all sorts of new consumer thingies. I mean, the world will not come to end in the coming year.
reply