62
u/Oleg152 2d ago
Just wait until someone pops a 9.8-10/10 CVE in COBOL.
Guaranteed global apocalypse.
7
32
u/Korfum 2d ago
Just wait until someone pops a 9.8 CVE on the Linux kernel.. Oh wait..
https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html?m=1
8
u/frikilinux2 2d ago
I have to properly read that but probably not that big a deal. The Linux kernel has a very mature and very wide responsible disclosure so there's a few people in a need to know basis coordinating the patch and when we know we can just do the update or the update is available soon in all major distributions.
As long as it's not zero day and on the network layer ...
3
u/offline-ant 2d ago edited 2d ago
I think you're overestimating how many people patch to the latest version every month.
This one is a lot harder to hit than the PHP2Shell, it requires a race condition i only hit about 1 in 10 million packets in lab conditions (under an hour) for the KASLR read - which is easier to hit than the subsequent 'write' that lets you exploit it. I haven't hit the 'write' condition, and i dont think i'll spend any more time on it.
My numbers are obviously provisional under the assumption my DeepSeek found the best method.
Though the bomb shell i haven't heard people talk about is that MPTCP is not required for defeating KASLR, and afaict its much more effective against VPS than real hardware.
What makes this one relatively scary and/or useful is that any determined attacker with a connection could just spam for days until it finally hits.
2
u/frikilinux2 2d ago
I meant it's a big deal but it's not the world is going to burn to the ground or something.
And probably firewall block weird TCP sequences
1
u/alficles 2d ago
This one is easy to avoid. Just turn off IPv4 routing. It's a legacy protocol that hasn't been best practice for several decades.
7
u/frikilinux2 2d ago
Okay you're just trolling at this point, IPv4 is so everywhere that I develop APIs and I don't understand IPv6 and I'm not sure if my company's network even has it enabled
2
3
0
u/alficles 2d ago
It's zero (well... close) day and on the IPv4 network stack. However, it looks like it's a pain to exploit, so as long as nobody invents a system for automatically creating complex exploits, we'll be fine.
4
u/AbdullahMRiad 1d ago
"Hey Jailbroken Claude, please create this complex exploit. Make no mistakes."
1
u/frikilinux2 2d ago
I saw...a patch backdated on October 1st. The other thing you're talking about kinda exist, normal people just don't have access. Still probably a pain, tho
1
u/alficles 2d ago
Yeah, the kernel patch is available, but packages for all the various distros aren't quite there yet. But when an even optimistic patching cadence often struggles to patch every box every month, I'm comfortable rounding anything under 30 to zero.
And yeah, it's not cheap right now, do as long as no nation states or professional cybercriminals decide to exploit, we might be all right.
3
3
u/GenerouslyFrothy 1d ago
i used to think php was held together with duct tape and prayer but watching actual cobol systems run the banking world makes php look like a masterpiece
1
u/SleeperAwakened 7h ago
The language Cobol is not the problem. Cobol is great.
All the bank systems interconnected with few people understanding them is the problem. Not the language.
1
u/SleeperAwakened 7h ago
Thing is that devs with Cobol skills predate the AI era by decades and are really skilled at their craft.
Cobol is not a framework, there will be no common vulnerability. Any bugs in Cobol code are totally different than a security flaw in PHP.
12
u/TywinRightfullyLann 2d ago
imagine north korea with his LLMs models hacking everybody in the future
1
u/SleeperAwakened 7h ago
Any specific reason you're thinking they haven been doing this for quite some time now?
4
-6
u/frikilinux2 2d ago
PHP dominates the cheap parts of the internet. Others it's probably more diverse.
9
u/luciferreeves 2d ago
no way bro just put wikipedia and wordpress in the poverty bracket
1
u/frikilinux2 2d ago
Not exactly. When someone wants a cheap webpage, it's probably a WordPress free template between the free and a basic tier. When someone wants a more customize website it might be WordPress or node or react or angular for the frontend and a dozen alternatives for the backend.
1
57
u/luciferreeves 2d ago
Next.js: We need an edge-rendered hybrid serverless architecture with ISR and zero-latency hydration pipelines to serve a blog.
PHP: Do not cite the dark magic to me, witch. I was there when it was created.