Oliver Sild

Nerding out on cyber security, community building, and open source software | CEO of @patchstackapp | 🇪🇪 Pärnu

[Oliver Sild @OliverSild]

In 2016, I made a post to Reddit that #WordPress (and other CMSs) need a proper vulnerability management tool and an effective way to prevent attacks against vulnerabilities in plugins. Here's what happened 🧵1/6

[Oliver Sild @OliverSild]

Big one! ⚡ @GoDaddy customers can now enable @patchstackapp to fight against the rising vulnerability threats.

https://t.co/esaHGWxlch

[Klaas @forgebitz]

remember scrum masters?

wild times

[Oliver Sild @OliverSild]

@RaminNasibov Prehistorik

[Oliver Sild @OliverSild]

AI presented as a cause for layoffs is just a bailout for not admitting over hiring during covid.

[David Sacks @DavidSacks]

Apollo’s Chief Economist: Zero Evidence of AI-Related Job Losses

[David Sacks @DavidSacks]

Apollo’s Chief Economist: Zero Evidence of AI-Related Job Losses

[Oliver Sild @OliverSild]

@zodiac1978 @patchstackapp Did you contact support? Let me see internally what happened.

[Oliver Sild @OliverSild]

@photomatt But I also believe closed SaaS website building platforms are in trouble in general.

[Oliver Sild @OliverSild]

@photomatt I agree my post is not very nice. I’m not celebrating, but just reflecting back to 5+ years where people kept saying Wix is ultimately taking over. It looks like they went from 3000 people to 6000 during covid, many layoffs happen atm because of covid overhires.

[Oliver Sild @OliverSild]

I think kids and gardening is the secret to happy life.

[David Sacks @DavidSacks]

Q: How are job postings for software engineers rising rapidly despite AI agents automating coding?

A: Because there’s far more code to manage than ever before. We’re already seeing a 14x YoY increase in GitHub commits, and it’s accelerating.

AI has dramatically lowered the cost of writing code, so it’s now being used across far more businesses, applications, and use cases.

We’re at the beginning of a massive productivity boom driven by the proliferation of bespoke software throughout the entire economy.

Coding has been AI’s breakout use case this year. The fact that it’s increased demand for software engineers — rather than decreased it — should call into question the entire “AI will cause mass job loss” narrative.

[Oliver Sild @OliverSild]

😭

[Oliver Sild @OliverSild]

@jameswlepage We’ve already seen an increase of supply chain attacks in the WordPress ecosystem recently. If there will be increased motivation to do those then updating plugins (especially auto-updates) could be weaponised and turned into an attack vector rather than a solution.

[Oliver Sild @OliverSild]

WordPress 7.0 combined with plugin vulnerabilities = free AI tokens. There will be an absolute rush by hackers to steal API keys.

[Oliver Sild @OliverSild]

@jameswlepage We’ve helped many large hosts scan their entire infrastructures to see how many sites are vulnerable (it’s part of our free POC) and and average of 70-90% of sites have had at least one vulnerability. They are not abandonned. The volume of new vulnerabilities is just high.

[Oliver Sild @OliverSild]

@jameswlepage I’m surprised Mythos was not given to WordPress .org to scan/secure core. Most sophisticated hacker attention has currently gone to NPM where breaching applications yield higher returns, that’s why you see TeamPCP, etc. cause havoc there. Now WordPress could become as valuable.

[Oliver Sild @OliverSild]

@jameswlepage not whether the implementation was wrong in any ways or faulty (I believe this was needed for WordPress to stay competitive), but about the fact that now hacking WordPress sites is more valuable, which increases the motivation to attack and find new vulnerabilities to exploit.

[Oliver Sild @OliverSild]

@jameswlepage Honestly, the fact that there has not been a critical vuln. found by AI in WordPress core is impressive and shows how secure WordPress is. However, almost no WordPress site is just WordPress core. Average number of installed plugins is still around 20. The question is…

[Oliver Sild @OliverSild]

@euthelup The value for hackers is very different. Stolen API keys of Anthropic, OpenAI, etc. sell at significantly higher prices than most other keys and are more universal (hackers can use stolen keys to tokenmax vulnerability research and the victims will pay).
https://t.co/qKJ4Zom8C6

[Oliver Sild @OliverSild]

@photomatt There is definitely a lot more sites that are not secure than those that are “perfectly secure”. All I’m saying is that hackers will be trying harder. We need to be prepared.

[Oliver Sild @OliverSild]

This

[Nagli @galnagli]

New "Critical" nginx RCE requires LFI as prereq and has 0 practical exploitation odds - CVEs & CVSS are the biggest slop in security and AI just keeps accelerating it