Imagine you wake up and:
- PHP has two critical vulnerabilities, rated 9.2, and exploitation has already started, even before the fix was published. There's not fix for old versions...
cybersecuritynews.com/php-ea…
- Node.js has four high vulnerabilities, including arbitrary code execution.
nodejs.org/en/blog/vulnerabi…
- Eight TLS intermediates have private keys of 3 to 8 bits. I don't believe in conspiracy theories, but...
arstechnica.com/security/202…
All of this is in the field. Millions of machines are vulnerable. Most of them will not be patched in the near future and you can't really trust TLS anymore...
The state of security is really, really frightening. And it won't get better anytime soon. 🫠