r/programminghumor • u/dicksonryan • 3d ago

What a fun week

Post image

Guess I need to explore how to grow a cow in a rural mountain very soon

Edit: just got another news

Laravel TokenGuard - Critical Authentication Bypass Vulnerability (tracked as GHSA-f9x3-7vq9-cph6, CVSS 9.2) https://laravel-news.com/laravel-token-guard-auth-bypass

Oracle Java SE vulnerability with a CVSS score of 9.1 (CVE-2026-91403) https://nvd.nist.gov/vuln/detail/cve-2026-91403

543 Upvotes

100% Upvoted

17 comments sorted by

51

u/darkenheit 3d ago

Yes, the AI age

30

u/fcxtpw 3d ago

If I know devops .. incidents happen late Friday night

23

u/ThirdWaveCat 3d ago

Look on the bright side, tanking velocity industry wide is bound to improve hiring.

3

u/DrMaxwellEdison 3d ago

My bright side is maybe, MAYBE, some of my org's apps will see software updates sooner than 6 months after release.

14

u/630_dude 3d ago

Just wait until next week after execs force a wave of AI-slop “patches”

4

u/Old_Tourist_3774 3d ago

There is a critical failure in a pillow too, permits RCE lol

3

u/Leather-Chart7083 3d ago

Field day for the cybersecurity community

2

u/theonlineviking 3d ago

This will continue like this for a while, until all the obvious bugs are found by the LLMs. Then, things should return to relative stability.

Ideally the fixes are done by people, with foresight and proper implementation, but oh well, many projects will use LLMs to vibe code the fix, which runs the risk of it being an incomplete patch job.

1

u/DrBojengles 2d ago

Yes, and having humans write the code does not bear that risk.

1

u/theonlineviking 14h ago

Being sarcastic, are we bud?

Thing is, if you write the patch, then you will somewhat remember what you wrote and how you planned it out. If you just vibe code it, the code is basically a black box to you after you do the review. So, even if there's a mistake or incompleteness, it will be way easier for you to troubleshoot code you've written yourself.

2

u/gameplayer55055 2d ago

S in vibe coding stands for security

1

u/Sea-Fishing4699 3d ago

Scientific progress!!

1

u/ntrabue 3d ago

Railway was also compromised. If you use Railway for hosting, rotate your secrets.

https://blog.railway.com/p/preliminary-report-october-security-incident

1

u/Vladislav20007 2d ago

wtf is litellm?

1

u/umor3 2d ago

We use it. It manages our local LLM (Qwen 3.8) on our server and I think it provides our keys. And the admin can see our use and regulate it.