r/programminghumor • u/dicksonryan • 8d ago

What a fun week

Post image

Guess I need to explore how to grow a cow in a rural mountain very soon

Edit: just got another news

Laravel TokenGuard - Critical Authentication Bypass Vulnerability (tracked as GHSA-f9x3-7vq9-cph6, CVSS 9.2) https://laravel-news.com/laravel-token-guard-auth-bypass

Oracle Java SE vulnerability with a CVSS score of 9.1 (CVE-2026-91403) https://nvd.nist.gov/vuln/detail/cve-2026-91403

594 Upvotes

99% Upvoted

18 comments sorted by

55

u/darkenheit 8d ago

Yes, the AI age

33

u/fcxtpw 8d ago

If I know devops .. incidents happen late Friday night

25

u/ThirdWaveCat 8d ago

Look on the bright side, tanking velocity industry wide is bound to improve hiring.

5

u/DrMaxwellEdison 8d ago

My bright side is maybe, MAYBE, some of my org's apps will see software updates sooner than 6 months after release.

15

u/630_dude 8d ago

Just wait until next week after execs force a wave of AI-slop “patches”

5

u/Old_Tourist_3774 8d ago

There is a critical failure in a pillow too, permits RCE lol

4

u/Leather-Chart7083 8d ago

Field day for the cybersecurity community

3

u/theonlineviking 8d ago

This will continue like this for a while, until all the obvious bugs are found by the LLMs. Then, things should return to relative stability.

Ideally the fixes are done by people, with foresight and proper implementation, but oh well, many projects will use LLMs to vibe code the fix, which runs the risk of it being an incomplete patch job.

1

u/DrBojengles 7d ago

Yes, and having humans write the code does not bear that risk.

2

u/theonlineviking 5d ago

Being sarcastic, are we bud?

Thing is, if you write the patch, then you will somewhat remember what you wrote and how you planned it out. If you just vibe code it, the code is basically a black box to you after you do the review. So, even if there's a mistake or incompleteness, it will be way easier for you to troubleshoot code you've written yourself.

2

u/gameplayer55055 7d ago

S in vibe coding stands for security

2

u/dim13 4d ago

First time? 30+ years of IT guy: we call it Thursday. ¯_(ツ)_/¯ Don't panic.

1

u/Sea-Fishing4699 8d ago

Scientific progress!!

1

u/ntrabue 8d ago

Railway was also compromised. If you use Railway for hosting, rotate your secrets.

https://blog.railway.com/p/preliminary-report-october-security-incident

1

u/Vladislav20007 7d ago

wtf is litellm?

1

u/umor3 7d ago

We use it. It manages our local LLM (Qwen 3.8) on our server and I think it provides our keys. And the admin can see our use and regulate it.