Still bleary eyed, but: Most severe ones are in SMB and KSMBD, which apparently have implementations in kernel space. I think this doesn't impact anyone not using KMB.
Others are LPEs, but two have been deleted by now, so can't be sure of the details.
TrendMicro's site opens up with a big big "Advancing AI-Native Security with Anthropic". Which checks out I guess.
Doesn't the Linux kernel encourage reporting on the public mailing list for kernel vulnerabilities that were found using AI? If I remember correctly they introduced that policy after the security mailing list got swamped with multiple reports for the same vulnerabilities
Finally the last vulnerabilities of the year.
The headline should include Trend Micro's name for shaming purposes. Amatuerish.
Still bleary eyed, but: Most severe ones are in SMB and KSMBD, which apparently have implementations in kernel space. I think this doesn't impact anyone not using KMB.
Others are LPEs, but two have been deleted by now, so can't be sure of the details.
TrendMicro's site opens up with a big big "Advancing AI-Native Security with Anthropic". Which checks out I guess.
Doesn't the Linux kernel encourage reporting on the public mailing list for kernel vulnerabilities that were found using AI? If I remember correctly they introduced that policy after the security mailing list got swamped with multiple reports for the same vulnerabilities
I'm not surprised because the disclosure process of https://hackerone.com is completely and openly public.
But they have also disabled Linux as one of the products that they work with.
What an entertaining season in the simulation
It's being a great season, techsecurity-wise.
On HN everyone is a security engineer.
They wanted "full stack", so they found hires with 1/10th of an education in each of 10 different fields.
The boss class are rich because they're smart. /s
> 1/10th of an education in each of 10 different fields combined FTFY
But they're cheap 10x engineers.
are those posted by AI?
"accidentally"
I feel paranoid enough now to blame ai companies to try to induce panic and proclaim "buy our product to save yourself"
To be honest and fair, in this situation I don't believe this is something accidental.
It probably just happens that the security concerns at ZDI don't match the security concerns at Linux(the vendor).
So, it turns out that this vendor is difficult to work with ....
I mean - heh
Agree, wild stretch to accidentally send this loot to a mailing list.