Security must shift left: patched exploits now spread at near-zero cost worldwide
fforres · x · 2026-10-23
In a long thread, security researcher esthor explains what 'shifting security left' really means, citing the eMudhra cert incident that required coordination across all major OSes, browsers, languages, and dozens of core libraries.
Key points:
- Exploiting an already-patched vulnerability is now near-zero cost and near-instant, so every downstream app and service must patch or apply workarounds immediately.
- Security responders will face increasing burnout for the next 1-2 years until security looks very different from the last 30 years.
- The fundamental vulnerability lies in the global architecture and norms — something 99.9% of SWEs and tech companies haven't grasped.
More from Infra
- IFM open-sources RL360: RL infra behind 8,192 concurrent sandboxes and 1.3M rollouts — rupspace · 2026-10-23
- Jensen Huang on NeoCloud financing worries: high demand solves everything else — inductionheads · 2026-10-23
- Developer says CPU compute demand is surging: 'I'm 110% compute constrained' — rakyll · 2026-10-23
- OverCompressing: A Lossless Archiver That Shrinks Fine-Tune Deltas to 0.1% — overdoingism · 2026-10-23
- FP32 vs. Fidelity: Indie Inference Engine Author Questions His Speed Trade-Off — ZenZombie117 · 2026-10-23
- You.com's Inference Router supports Kimi K3, GLM 5.3, Qwen3.8 Flash via one-line base URL switch — RichardSocher · 2026-10-23