91
For users with public facing services: How does the current explosion of AI-discovered vulnerabilities affect your threat model and willingness to be public facing? (lemmy.ml)
submitted 2 weeks ago by to c/selfhosted@lemmy.world
63 comments fedilink hide all child comments
 

PHP, TLS, etc.. We appear to be facing a tsunami of vulnerabilities being discovered in record time. Further, the window to act on these vulnerabilities has basically closed to zero; hackers' tools now automatically fold the very latest vulnerabilities into their botnets within minutes/hours of discovery. I have always been extremely reluctant to expose any of my services - even with the latest and greatest security tools. My choice to stay totally within the confines of tailscale seems vindicated given this week's news. How are you all taking this?

https://pwn.watch/

you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 2 weeks ago (16 children)

I'm not worried. I have auto updates on and have a well hardened setup following all the good basic principles. I have had a fully public facing server for years with no issues. My php was patched and updated totally automatically a few hours after the update became available. My web server is extremely low volume traffic and there is hardly any reason for random people to be using it, so chances of somebody attempting something against it at just the right time a vulnerability has been discovered but not patched is very low chance. When a critical vulnerability appears, hackers are going to target the big fish for big wins initially, even so, it takes effort to turn a vulnerability into an actual exploit and deploy it. I could step out my front door and get run over by a bus, but I don't worry about it and stay on doors all day to mitigate the risk.

  • permalink
  • fedilink
  • source
  • hideshow 16 child comments
    •
  • [–] [S] 2 points 2 weeks ago (15 children)

    I have had a fully public facing server for years with no issues.

    To be fair, that was before AI was finding all these holes.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 15 child comments
    •
  • [–] 2 points 2 weeks ago (14 children)

    To be fair, my server has been public facing for the entire time these ai models have been finding vulnerabilities.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 14 child comments
    •
  • [–] [S] -3 points 2 weeks ago (13 children)

    October 2026 AI is drastically better at finding these holes compared to pre 2026 AI. Do you agree?

    It seems like your main point is that the threat has not elevated. But the news from this week proves that is wrong, I feel.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 13 child comments
    •
  • [+] 4 points 2 weeks ago (1 child)
    [deleted]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 2 weeks ago

    Thats exactly what all this is. If the SOTA models find a "critical" vulnerability every month or so, they get a huge shout out in the news and press globally which is some really appreciated and positive free marketing. Yes, ai has changed alot of things, some for the good some for the bad, but i dont feel like online risk has changed massively. AI finds vulnerabilities for milicious actors and cybersec bods quicker and more regularly than pre-ai, but both sides have the same tools so the same improvements, net effect is they cancel each other out. Anybody with serious about there stuff online already has sytems and processes setup to deal with patching stuff immediately. i barely touch my server for maintenance, just check stuff when im bored and make sure everything is doing what it should.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 5 points 2 weeks ago (10 children)

    Ai tomorrow better than ai today? Yes, that is true any day of any year. I don't get your point 🤷

    A vulnerability was found, that vulnerability was patched. I think it's great news that vulnerabilities are being found and fixed faster than ever. Do you agree?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] [S] -3 points 2 weeks ago (9 children)

    Throughout 2026, IBM X-Force observed a dramatic increase in publicly disclosed vulnerabilities across major software vendors, including Microsoft, Oracle, Google Chrome and Apache. While the causes behind this increase are difficult to quantify, recent advances in AI-assisted vulnerability research demonstrate how vulnerability discovery can now occur at unprecedented scale. In August 2026, Unit 42 published a report highlighting that its autonomous vulnerability discovery platform, NOVA, identified more than 14,000 previously undiscovered vulnerabilities across nearly 4,000 open-source projects in just two months. The question is no longer whether AI can help researchers find vulnerabilities, but whether AI is changing vulnerability discovery faster than organizations are prepared to manage the risk.

    Vulnerability disclosures are up 578% in 2026 across major software vendors. Publicly disclosed CVEs across Microsoft, Oracle, Google Chrome and Apache increased from approximately 1,493 disclosures during January-September 2025 to more than 10,124 during the same period in 2026, representing roughly a 578% increase. The acceleration became most apparent in Q2 2026. Vulnerability disclosure volumes remained relatively stable through the first quarter before increasing sharply beginning in April and continuing through the summer months.

    https://www.ibm.com/think/x-force/ai-vulnerability-discovery

    Your head's in the sand, friend.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 5 points 2 weeks ago (3 children)

    It's really not the publicly disclosed vulnerabilities you need to worry about. Most of those vulnerabilities have existed for years - the recent php thing is supposedly 12 years old. Maybe someone's been out there exploiting it for 12 years.

    The people who have sought and exploited vulnerabilities since computers went online don't disclose what they find. They are the people who should be most worried about AI-assisted vulnerability research, because it directly attacks their business model.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 2 weeks ago (2 children)

    10000% correct! I bet the NSA or KGB has had that PHP exploit for close to a decade and they are gutted its finally been patched! There are probably an infinite number of vulnerabilities in currently running servers and clients, a few 100 will already be known and being quietly exploited. Yes, ai will find some completely unknown ones for malicious actors, but it will also find those same ones for cybersec bods, so effectively cancel each other out.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 2 weeks ago (1 child)

    Do security companies like cloudflare go back and look for past exploitation of vulnerabilities that were recently found by the public? I can't think of any "we found this new vuln and turns out someone has been exploiting it for years" stories.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 weeks ago

    Maybe not, but maybe, just maybe, the people with these exploits aren't running round attacking Joe bloggs personal photo album server to steal some photos, but in fact are only using the exploit very carefully and sparingly so as not to be detected, and only targeting high value and highly confidential services, where even if they were hacked or a specific exploit was deployed, either are too big to notice, or to proud to divulge the fact they lost some data 🤷

  • permalink
  • fedilink
  • source
  • parent
  • [–] 8 points 2 weeks ago (4 children)

    I have no idea what you are on about. What do you want me to do? Turn the internet off? Lock my doors and not leave the house? Sit here crying and quivering because the world is gonna end? My head is deffo not in the sand, I'm looking out the window at the rain, enjoying my life, looking forward to tomorrow.

    I'm not worried about my web server any more today then I was last year. It's a web server, it's not me or my life, yes it how important stuff, but if the world ends it'll be the last thing I think of.

    My web server is as safe as it needs to be. Thanks for your concern.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 2 weeks ago (3 children)

    There's a world of possibilities between "public facing server" and "turn the internet off". Like using a VPN or mTLS. Or only connecting when you are at home.

    However it sounds like you aren't worried about the increased threat landscape, or at least aren't willing to compromise on your current level of convenience. That is a fair answer to OP's question.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 2 weeks ago (2 children)

    To me there is no increased threat landscape. The world is a scary place, full of baddies trying to get you. Since the dawn of the internet there has been vulnerabilities being found and used maliciously. Just because the big tech sota models are shouting about how great they are by finding them, giving them some nice free marketing, doesn't mean that much has changed.

    Ok, ai has increased the frequency and amount being found, but that is equally increased both for malicious and cybersec, so it essentially cancels out.

    My server is public facing and secure, so that both myself, family and friends can use it, especially for the less tech savvy.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] [S] 1 point 2 weeks ago (1 child)

    Ok, ai has increased the frequency and amount being found, but that is equally increased both for malicious and cybersec, so it essentially cancels out.

    This is not what experts are saying.

    https://therecord.media/ai-set-to-help-attackers-more-than-defenders

    https://www.sophos.com/en-us/blog/why-incident-response-demand-will-grow-faster-than-expected

    https://matthew-rosenquist.medium.com/why-cyber-attackers-benefit-more-from-ai-technology-than-defenders-98efd14ac664

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 weeks ago

    You're determined that I worry about my public server aren't you? Your initial question wasn't actually a question, but just a trap for you to lure me into to be converted to your way of thinking?!?! rumbled! 😂 There are always experts to quote for any argument. Personally, I don't feel any more vulnerable than before ai decimated the security landscape.

  • permalink
  • fedilink
  • source
  • parent