269
Google pays $250K for Linux vulnerability allowing guest VM escapes (arstechnica.com)
submitted 4 months ago by to c/selfhosted@lemmy.world
42 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 101 points 4 months ago (14 children)

A separate vulnerability in Linux allows users with limited rights to escalate to root. Tracked as CVE-2026-43499, it lurked in the OS for 15 years. Researchers from Nebula Security said they discovered it using Vega, Nebula’s AI-assisted vulnerability scanner. Matt Lucas, a researcher and founder of RedEye Security, explained

This will become more and more common as we use AI to find vulnerabilities faster (hopefully) than bad actors can use AI to find vulnerabilities.

  • permalink
  • fedilink
  • source
  • hideshow 14 child comments
    •
  • [–] 87 points 4 months ago (5 children)

    If you pay attention you can hear a hundred NSA assholes tear their hair out

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 42 points 4 months ago* (last edited 4 months ago) (1 child)

    20 years of hoarding CVEs down the drain.

    Now they'll never be able to gg ez their way into any country and will have to actually use their bribery budget to get more implants lol.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 21 points 4 months ago (1 child)

    Keep in mind that the rate of errors caught by AI will not be consistent. It will drop off over time.

    While I'm no fan of AI, that has nothing to do with it. Adding AI to error detection suites is (mostly) fine so long as you don't remove more tradional methods like code review, manually set up unit tests, and properly reviewing each failed test instead of just letting the AI slop in a patch.

    My point is that any test you add to an existing codebase is going to catch a decent number of issues at first, then over time it will drop off as pre-existing issues get resolved. Then you'll be left with the lower rate of new issues from updates.

    AI isn't a silver bullet. It (sometimes) is another tool in the toolbox.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [+] -19 points 4 months ago (5 children)

    as we use AI to find vulnerabilities faster (hopefully) than bad actors can use AI to find vulnerabilities.

    Oh small, simple child: who do you think has the better access to AI in the first place?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 24 points 4 months ago* (1 child)

    This is a reminder that US scientists during the cold war thought fish were russian subs because they didn't have biologists on staff

    Judging by the way they've treated big companies in the past the NSA is staffed by a bunch of people who use backroom deals with US tech companies to collect their data mostly.

    I actually think a large plurality of them spend most their time tracking/stalking their wives and like people they argued with the day before.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 8 points 4 months ago (2 children)

    small, simple child:

    Didn't downvote you but.....

    LOL! The level condescension sure is right on point Lemmy.That genuinely got a chuckle. In some ways I enjoy being that simple child. Full of wonderment at this universe around him.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •