I think the pingcap hack might be the biggest of them all, somehow it has gone under the radar.

[0] https://news.ycombinator.com/item?id=50173716

Also GitLab

https://docs.gitlab.com/releases/patches/patch-release-gitla...

Any guesses as to source attribution? It seems too many to be multiple different orgs.

And about 50+ sev 9+ CVEs for the linux kernel

And litellm too

[dead]

Why is a 300k mrr company (his tiwtter bio) running on raleway?

Brother do not cancel anything for these people, they do not care about you, it's their fault for not considering bus factor in their org chart. Why can't the person above you handle that?

Prioritize your mental health, go enjoy your vacation.

Not your problem. Enjoy your vacation. Bus factor of 1 is poor planning of leadership.

Either a) your company will reimburse you for your costs incurred and give you a different week off, or b) they don’t need you there that badly.

I say this as a Railway customer, go take your vacation. The only time you should even reconsider is a massive bonus plus more time off for staying.

None of this matters if you zoom out.

Environment variables are a terrible place to store secrets.

I'm just going to say it, since having said it non-stop for over 20 years, nobody seems to listen and we keep circling this drain.

The 12 Factor manifesto was 100% wrong on this point.

Use environment variables to point to where secrets are located, not to store their values.

The security team at my company is working with a frontier lab to scan all our code/systems. They are in a borderline panic to close every possible issue, even innocuous ones that are buried under defense in depth. Whatever they are seeing from our partner has them spooked -- as in "acceptable risk" is no longer a thing anymore.

I fully believe the only sustainable future is that hot patching will need to itself become fully automated. Hot patch now with a minimal allowed amount of line changes to head off the AIs, review it in office hours for auditing and the team is actually awake.

My second belief is that environment variables as a development concept will need to be retired. If it's something that causes a security breach if it by its mere existence on a public git repo, it is information that by design cannot ever pass to a filesystem out of a chain of trust, not by mere development conventions people choose to adhere to.

The internet is over. We are going back to static htmls for public pages, and Point to Point VPN bases connections for B2B service provision.

B2C? too risky to publish services online haha.

It's only just starting. It'll get worse before it gets better.

I think the only way out is to go back to on-prem for everything, like in the 00s.

LAN cables will go up in price soon.

surely once there's been enough patches the code will be perfect though?

It's going to be a rough decade.

I'm already tired, between pushing back on vibe coded internal projects being put onto the internet and then the constant barrage of CVEs that mean nothing.

Then you have real security incidents that you need to tune into constantly.

job security!

Not a bad idea

I've already taken my applications offline and will be migrating to a new host...

Yep. What an incredibly frustrating notice. I like Railway and I guess their hands are tied here, but wow.

I rotated mine. If you just change the keys and hit deploy it works

Easy, all the bad guys need to do is access whatever system stores the decryption keys.

That’s coming for all platforms unfortunately

companies probably have php and Python applications exposed to the web and nobody knows.

the speed of irresponsible deployments is infinite now, by design

Defending is so much harder than attacking. You don't even have to focus on one target, as you can just mass-AI-script a lot of attacks wherever it's possible, and see what sticks. Even if you did everything right, there's always the social-engineering angle, or a single compromised device, or just accidental bad upgrade through supply chain. If you can mass-spread the seed, and plant something that "calls home" constantly, you can just have an agent that would start the attack the minute it gets infected, and go deeper.

It's really a wild west right now, have no idea how we fix it. I'm assuming everything will get more concentrated in big co's hands, as having a very robust security is extremely hard.

Also, we have to agree that younger people will start companies. There will be small companies that cannot afford red teams. There will be companies that are just not equipped, and their profit margins cannot sustain constant attacks.

> It’s funny that every security breach disclosure now has a mandatory “the attacker used AI!”

This isn't in the article? They do not at all claim "the attacked used AI!".

The only mention of "AI" is "We believe this is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers." This is the same (apparently) end-goal as the Opencode breach last week, and is not blaming or finger-point at AI. It is stating (rightfully) that AI inference is very easy to resell and turn stolen credentials into cash.

> your own red teaming should have found them before the attacker did

Easier said than done. The defender has to do everything right, all the time, to prevent a headline like this. The attacker only needs to be right once, and it's game over. AI or no AI.

Unless they edited the post, they never said this. You should delete this; it's false information.

I didn’t actually see that in this post at all. They mention that the end goal of the attackers might be to get to AI inference providers. But I don’t think they are crying “AI was used” here.

Or did I miss something?

This one doesn’t?

Of course, it was a giant scam that tested for nothing and optimized for how to pass a test.

Let's see if companies are ready to hire more people who know what they are doing, against a super-intelligent swarm of millions of agents with cyber capabilities.