The point is that it's getting a lot easier to find security holes that people would be unlikely to spot. They might be hard to exploit, but when they're not it'll be a massive problem. We can't exactly assume they'll all be difficult.
With the advent of agents, easy or hard doesn't matter much. One in thousands of agents will likely find a way, and that's what matters.
The related public challenge (https://github.com/KillaBoi/StealMyBitcoin-PoC) has been hacked after around 19 hours. It's up to debate whether it's really representative (at first it wasn't for sure, but it's been corrected), but shows that there has been an exploitable RCE pathway.
4 comments
[ 0.28 ms ] story [ 26.7 ms ] threadAll of the POCs I found have hard coded memory addresses for the heap overflow and won't work for many versions out-of-the-box.
With the advent of agents, easy or hard doesn't matter much. One in thousands of agents will likely find a way, and that's what matters.
The related public challenge (https://github.com/KillaBoi/StealMyBitcoin-PoC) has been hacked after around 19 hours. It's up to debate whether it's really representative (at first it wasn't for sure, but it's been corrected), but shows that there has been an exploitable RCE pathway.
It is a common technology, well supported in the Red Hat family, and (I would hope that) dnf update will be the proper step for most people.