Is this the new cyber normal?
The cyber landscape just got significantly spicier with a flurry of critical vulnerabilities, many accelerated by AI's rapid exploit generation. Hacker News is locked in a heated debate over whether this hyper-vulnerable state is our 'new normal' or a mere transitional phase. The core question: can our security practices evolve fast enough to cope with algorithmic adversaries, or is the internet fundamentally broken?
The Lowdown
A recent surge in severe and critical software vulnerabilities has sent the internet into a panic, prompting questions about the future of cybersecurity. This wave of incidents, many linked to the advanced capabilities of AI models in discovering and exploiting bugs, paints a concerning picture of an accelerated threat landscape.
- PHP2Shell (CVE-2026-109618, CVE-2026-109619): Two Remote Code Execution (RCE) bugs in PHP were found by frontier AI models, affecting an estimated 70% of the internet. A previous human audit had flagged one, but AI rapidly created working exploits, leading to widespread exploitation even before official patches were fully available.
- eMudhra (CVE-2026-111943): Mozilla blocked certificates from this Indian certificate authority after critically weak private keys were discovered. While not AI-discovered, LLMs could easily recover the keys with a single prompt, highlighting fundamental security flaws.
- Railway Cloud Breach: Evidence emerged of hackers accessing and decrypting environment variables from the cloud provider, possibly targeting companies using AI inference services. The motive remains unclear, but it points to a broader, concerted effort.
- GitLab Vulnerabilities (CVE-2026-97229, CVE-2026-110264): Two maximum-severity RCE flaws were found in GitLab CI/CD's regex parsing, continuing a trend of critical bugs reported through their bug bounty program. These were not explicitly linked to AI discovery.
- musl libc bug: A denial-of-service or RCE bug was announced in musl's libc, related to regex handling, coincidentally aligning with the GitLab regex-related issues, but appearing to be a distinct discovery.
- LiteLLM Compromise: A malicious version of LiteLLM was found on PyPI and Docker, stealing credentials, echoing a similar incident earlier in the year. Analysis showed 'strong indications of LLM-aided development' in the payload.
- PingCAP Breach: The database company experienced unauthorized access, with a cyber extortion group claiming 10.6 TB of data exfiltration and publicizing egregious security practices, including API keys in Jira tickets.
- Linux Kernel Vulnerabilities Leak: Several high-severity Linux kernel CVEs were accidentally posted to a public mailing list instead of a private one, raising fears of rapid, AI-driven exploit generation.
The article concludes by exploring potential responses, from closing source code (the 'Madagascar approach') to embracing AI for defensive purposes or hoping for universally better security practices. It acknowledges the significant, possibly irreversible, impact of AI on software security, urging the software community to ensure these changes benefit everyone, not just special interests.
The Gossip
The Great 'New Normal' Debate
Commenters fiercely debate whether the current onslaught of cyber vulnerabilities signifies a 'new normal' or merely a transitional phase. Some believe this rapid pace, driven by AI's ability to find and exploit bugs, is here to stay, making life materially worse for defenders. Others are more optimistic, suggesting it's a temporary 'gold rush' to clear a backlog of decades-old bugs, after which AI-assisted development and security tools will lead to more robust software. There's also a view that this is just the 'old normal' with faster tools, highlighting persistent issues like neglected patches and overly complex software.
AI's Double-Edged Sword in Security
A central theme is the ambivalent role of AI. While LLMs are clearly accelerating the discovery and exploitation of vulnerabilities, there's significant discussion about their ability to write secure code. Some argue AI-generated code is 'notoriously terrible' at security, potentially creating new classes of bugs or making developers overly reliant on automation. Conversely, many report that LLMs are excellent at finding bugs in existing human-written code and can even help remediate them faster, suggesting a path to better overall security if used correctly and with human oversight. The consensus seems to be that AI is a powerful tool, but its output requires careful scrutiny.
Disclosure Dilemmas and Rapid Exploitation
The dramatic shortening of the window between vulnerability discovery and widespread exploitation, largely attributed to AI, raises critical questions about disclosure practices. Commenters lament the current 'delay' strategy, where security embargoes are often breached or rendered useless by AI's speed. Many argue for immediate public disclosure so everyone can patch, while others counter that this merely gives attackers a head start. The accelerated cycle means defenders need to be incredibly agile, with some foreseeing a future where automated agents continuously monitor and respond to disclosures.
The Inherent Insecurity of Software
Beyond AI's immediate impact, discussion delves into the long-standing issues contributing to software insecurity. Commenters highlight that 'software has always sucked' and is often excessively complex, with fundamental problems like regex engine vulnerabilities persisting for decades. Suggestions for improvement include a shift towards simpler architectures, increased use of memory-safe languages like Rust, and treating security as a prerequisite rather than an afterthought. There's also an acknowledgment that the web, with its pervasive client-side code execution, might have taken a 'wrong turn' long ago, and that the current crisis is merely making these foundational flaws glaringly obvious.