AI Is Finding Your Vulnerabilities Before You Do

Last week a cluster of critical vulnerabilities landed on the same day. PHP2Shell and Node2Shell both allowed unauthenticated remote code execution. GitLab shipped a CVSS 10.0 flaw in the Ruby regex engine that affected every self-managed release back to version 7.0. A Python CVE rounded out the set. Some people started calling it Black October.

Matt and Robert talk through how these issues arrived together, why so many landed on a Wednesday, and what CVSS scores actually mean when they hit 9 and 10. They look at how AI models found some of the bugs with short prompts, how coordinated embargoes are fraying, and how the time from public disclosure to active exploit attempts has collapsed from weeks or months down to hours.

They also cover what this does to organizations that still patch on a monthly or quarterly cycle, why some teams took sites offline rather than risk exposure, and the practical trade-offs for open source maintainers and the people who depend on their projects. The episode ends with a question for listeners: if AI keeps getting better at finding issues, does open source become safer overall, or do we just run a permanent high-speed patch race?

Links