I wouldn't expect the PHP team to provide patches for versions for which security support has ended. But this seems like the kind of task that AI is especially well suited for-- rework the patch for a release that is no longer supported but still widely used. It would've been nice for people who have much older sites to be able to patch their PHP rather than have to upgrade PHP as well to get the fix.

How did we find this?

No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase. This shows that "know your target" is still as applicable as ever, even in the LLM dominated VR age. No model is simply capable of unearthing "all bugs" with simple prompts. At least for now.

There are some practical research implications here. LLMs may have ingested public historical vuln data, but in their default variant analysis tends to move from the newest and most prominent bugs toward nearby older code. They do not reliably begin with obscure twenty-year-old exploitation primitives. Keeping your own mental catalog of a target's vulnerability history lets you prompt that direction explicitly.

How can we help identify and fix vulnerabilities in downstream packages while upstream fixes are pending, or backport fixes to older versions that no longer receive security updates?

Is the company selling a magical code generation machine really asking how it can backport a fix to an older version of the same software?

Is this for real?

Just give us the damn code to verify things are working since so many have to use stopgap solutions and want to verify them

Emergency patching. When, if ever, should governments or other operators use a vulnerability to patch systems they own or are authorized to manage after losing administrative access? What safeguards should apply? We can imagine an end-state of internet-wide always-on scanning for known vulnerabilities, and either notifying site owners when one is detected or patching the system.

The wild stuff is at the end. They propose someone (who?) auto-patching even systems they don't own.

Patch the Planet

I'm sure they named it after the "Hack the planet" slogan from the Hackers movie.

So how many tokens can I put you down for.

At this point I'm all for having zero coordination and just disclosing bugs, at least it doesn't create special class of priviledged people that get the patches first

Google used to be the laughingstock but now it's openai.

last place by far.

How much time will be left in the Defender’s Window between now and an organization getting Daybreak Access?

Who cannot type "php --version" but can use skills?

And even hackernews falls for it, what can we expect from MSM.

OpenAI consistently doesn't know what they're talking about.

Some people are acting like this is only a problem because labs are releasing models that can find and exploit these vulnerabilities in the first place. This is a nonsense claim. Humans have been discovering vulnerabilities and privately weaponizing exploits just fine for decades. We are collectively raising the floor for security.

Check it out: PatchWave (https://patchwave.ai)

(Disclosure - I am a co-founder)

Response: "What's the prompt?"

Yep. I might take minimum wage interns and make million dollar software(or million dollars in 2023), but they often run into issues that a 5 minute review with me solves.

I do wonder if AI is going to eliminate prompt engineering... It's basically all I have left. I feel like I have magic words.