Researcher: Stop confusing vulnerability disclosures with active exploitation
sebkrier · x · 2026-10-22
Security researcher S1r1u5 argues people are conflating vulnerability disclosures with active exploitation, fueling unnecessary panic — most recent incidents are researchers finding and fixing bugs early. He categorizes recent events: of the Oct 17-21 wave (php2shell, Node.js, GitLab, Railway, LiteLLM, SBI, eMudhra, Plex2Shell, SiteGuard, Siemens, OVHcloud CLI, OpenCode), only a handful (Plex2Shell, SiteGuard, Siemens) saw active exploitation; Railway, LiteLLM and OpenCode were real breaches/supply-chain compromises, while the rest were responsible disclosures already patched.
More from Safety
- Defense must run at machine speed: agents patch, engineers judge — saranormous · 2026-10-22
- CVEs jumped from ~4k to ~15k a month since April, and the security treadmill is breaking — saranormous · 2026-10-22
- US government reportedly pressed Anthropic to slow mythos cyber rollout — bookwormengr · 2026-10-22
- OpenAI restricts Daybreak access for security researchers, critics call it a mistake — andersonbcdefg · 2026-10-22
- Security engineers rush to secure Drupal and PHP apps amid exploit wave — unixterminal · 2026-10-22
- Internet Archive fends off PHP attacks overnight, using Claude to patch old code — kingslyj · 2026-10-22