PHP, TLS, etc… We appear to be facing a tsunami of vulnerabilities being discovered in record time. Further, the window to act on these vulnerabilities has basically closed to zero; hackers’ tools now automatically fold the very latest vulnerabilities into their botnets within minutes/hours of discovery. I have always been extremely reluctant to expose any of my services - even with the latest and greatest security tools. My choice to stay totally within the confines of tailscale seems vindicated given this week’s news. How are you all taking this?
Answering the titular question, why would the advent of AI-found vulnerabilities substantially change one’s threat model? Before LLMs, the prospect of an undiscovered vulnerability was non-zero probability then, so what exactly has changed now?
In terms of attacker capabilities, it would be a mistake to solely observe that attackers now have LLMs and conclude that this means the threat landscape has changed. The use of LLMs does not magically create a root escalation where one does not or cannot exist. Part of your threat model should include defense-in-depth mitigations, so that when (not if) an attacker finds a 0-day exploit, they are severely limited in gained functionality on your machines. In the simplest cases, jails or containers serve to keep separate the web-facing processes. VM isolation would be a further step, because an attacked cannot gain machine control without both a software exploit as well as a VM escape route. People hosting services can and should expect that their front line defense will fall, so they better have more defenses in place.
Phrased another way, the people who have done their threats analysis properly and have accepted the residual risk of hosting their own services that face the web, should not really be additionally perturbed by AI advances. This isn’t the same caliber of landscape change as would, say, the invention of a cryptographically relevant quantum computer. If the worst thing that can happen to your home IRC server is that it gets flooded by a script kiddie, AI does not mean your server can now burst into flames.
Much like with human hygiene, some basic rules are unusually effective against most threats. The equivalent to washing one’s hands is to stay on top of system and software updates. Institutionally funding the organizations (eg PHP Foundation, curl, USA CDC) so they can fix these problems would also help.
Before LLMs, the prospect of an undiscovered vulnerability was non-zero probability then, so what exactly has changed now?
The problem is not the prospect of an undiscovered vulnerability (there is always a vulnerability somewhere) but rather the prospect of a reduced response window.
There’s a wide gap of difference between “non-zero probability” (0.0076%) and “non-zero probability” (82.01734%).
not at home but i work as a software dev for a very big company you heard of and all we do noe is fix ai found security bugs. hell the stuff i work on isnt that public and we are still fixing. i can only imagine what the team of the public website are handling.
Eh between cloudflare blocking everything outside the US and tailscale for privileged control surfaces I’m not super worried.
My public facing server uses a wildcard domain cert plus it’s hosted on an uncommon higher port. It only serves static pages. My SSH port is hidden behind a WireGuard connection. I keep it extremely simple because simple is easy to maintain.
I’ve always treated my home server with public facing services as presumptively compromised. I don’t put any data on there I wouldn’t want to see become public, and any data I actually care about losing is backed up to the cloud with an append-only key. The NixOS config lives in a git repo not on the server. If something bad happens, I can wipe the machine clean, redeploy the image, restore my backups, and we’re back to the status quo.
So, my threat model hasn’t changed much!
If tailscale gets compromised I’m fucked. Otherwise I won’t be opening anything else up given my limited experience.
I had a public facing jellyfin. I took it down because of that.
Immich and nextcloud are still up.
I’m not saying there is a rational reasoning behind it.
I’m not worried. I have auto updates on and have a well hardened setup following all the good basic principles. I have had a fully public facing server for years with no issues. My php was patched and updated totally automatically a few hours after the update became available. My web server is extremely low volume traffic and there is hardly any reason for random people to be using it, so chances of somebody attempting something against it at just the right time a vulnerability has been discovered but not patched is very low chance. When a critical vulnerability appears, hackers are going to target the big fish for big wins initially, even so, it takes effort to turn a vulnerability into an actual exploit and deploy it. I could step out my front door and get run over by a bus, but I don’t worry about it and stay on doors all day to mitigate the risk.
I have had a fully public facing server for years with no issues.
To be fair, that was before AI was finding all these holes.
To be fair, my server has been public facing for the entire time these ai models have been finding vulnerabilities.
October 2026 AI is drastically better at finding these holes compared to pre 2026 AI. Do you agree?
It seems like your main point is that the threat has not elevated. But the news from this week proves that is wrong, I feel.
Ai tomorrow better than ai today? Yes, that is true any day of any year. I don’t get your point 🤷
A vulnerability was found, that vulnerability was patched. I think it’s great news that vulnerabilities are being found and fixed faster than ever. Do you agree?
Throughout 2026, IBM X-Force observed a dramatic increase in publicly disclosed vulnerabilities across major software vendors, including Microsoft, Oracle, Google Chrome and Apache. While the causes behind this increase are difficult to quantify, recent advances in AI-assisted vulnerability research demonstrate how vulnerability discovery can now occur at unprecedented scale. In August 2026, Unit 42 published a report highlighting that its autonomous vulnerability discovery platform, NOVA, identified more than 14,000 previously undiscovered vulnerabilities across nearly 4,000 open-source projects in just two months. The question is no longer whether AI can help researchers find vulnerabilities, but whether AI is changing vulnerability discovery faster than organizations are prepared to manage the risk.
Vulnerability disclosures are up 578% in 2026 across major software vendors. Publicly disclosed CVEs across Microsoft, Oracle, Google Chrome and Apache increased from approximately 1,493 disclosures during January-September 2025 to more than 10,124 during the same period in 2026, representing roughly a 578% increase. The acceleration became most apparent in Q2 2026. Vulnerability disclosure volumes remained relatively stable through the first quarter before increasing sharply beginning in April and continuing through the summer months.
https://www.ibm.com/think/x-force/ai-vulnerability-discovery
Your head’s in the sand, friend.
I have no idea what you are on about. What do you want me to do? Turn the internet off? Lock my doors and not leave the house? Sit here crying and quivering because the world is gonna end? My head is deffo not in the sand, I’m looking out the window at the rain, enjoying my life, looking forward to tomorrow.
I’m not worried about my web server any more today then I was last year. It’s a web server, it’s not me or my life, yes it how important stuff, but if the world ends it’ll be the last thing I think of.
My web server is as safe as it needs to be. Thanks for your concern.
I have HTTP(s) exposed, plus a wireguard port. HTTP points at a traefik gateway running in a kubernetes environment, based on hardened talos and using cilium network policies to isolate and direct traffic. I know that I am not super safe, but given this weeks news I think the only way to be truly safe in terms of cybersecurity is to use paper notebooks, snail mail and a subscription to the local print newspaper and no digital services whatsoever. In other words: how certain can we be that tailscale, or wireguard in general, or any other securit tool isn‘t suddenly at risk? Can we live with that risk? There always was a trade-off you had to make. Unfortunately „just use lets-encrypt, fail2ban and key-auth for ssh“ isn‘t really cutting it anymore.
I don’t have a public facing website but I was in the process of building one for fun prior to all this.
I completely locked down. Nothing leaves tailscale pretty much. If I do need a public facing site it will be built on other peoples platforms and nothing local.
In my case, building a site would be for fun, not for anything else. AI turning it into a maintenance chore just kills any excitment that used to exist for it. If anything, I’ll probably build it on neocities at this point.
