In 2016, I made a post to Reddit that #WordPress (and other CMSs) need a proper vulnerability management tool and an effective way to prevent attacks against vulnerabilities in plugins. Here's what happened 🧵1/6
@photomatt I agree my post is not very nice. I’m not celebrating, but just reflecting back to 5+ years where people kept saying Wix is ultimately taking over. It looks like they went from 3000 people to 6000 during covid, many layoffs happen atm because of covid overhires.
Q: How are job postings for software engineers rising rapidly despite AI agents automating coding?
A: Because there’s far more code to manage than ever before. We’re already seeing a 14x YoY increase in GitHub commits, and it’s accelerating.
AI has dramatically lowered the cost of writing code, so it’s now being used across far more businesses, applications, and use cases.
We’re at the beginning of a massive productivity boom driven by the proliferation of bespoke software throughout the entire economy.
Coding has been AI’s breakout use case this year. The fact that it’s increased demand for software engineers — rather than decreased it — should call into question the entire “AI will cause mass job loss” narrative.
@jameswlepage We’ve already seen an increase of supply chain attacks in the WordPress ecosystem recently. If there will be increased motivation to do those then updating plugins (especially auto-updates) could be weaponised and turned into an attack vector rather than a solution.
@jameswlepage We’ve helped many large hosts scan their entire infrastructures to see how many sites are vulnerable (it’s part of our free POC) and and average of 70-90% of sites have had at least one vulnerability. They are not abandonned. The volume of new vulnerabilities is just high.
@jameswlepage I’m surprised Mythos was not given to WordPress .org to scan/secure core. Most sophisticated hacker attention has currently gone to NPM where breaching applications yield higher returns, that’s why you see TeamPCP, etc. cause havoc there. Now WordPress could become as valuable.
@jameswlepage not whether the implementation was wrong in any ways or faulty (I believe this was needed for WordPress to stay competitive), but about the fact that now hacking WordPress sites is more valuable, which increases the motivation to attack and find new vulnerabilities to exploit.
@jameswlepage Honestly, the fact that there has not been a critical vuln. found by AI in WordPress core is impressive and shows how secure WordPress is. However, almost no WordPress site is just WordPress core. Average number of installed plugins is still around 20. The question is…
@euthelup The value for hackers is very different. Stolen API keys of Anthropic, OpenAI, etc. sell at significantly higher prices than most other keys and are more universal (hackers can use stolen keys to tokenmax vulnerability research and the victims will pay).
https://t.co/qKJ4Zom8C6
@photomatt There is definitely a lot more sites that are not secure than those that are “perfectly secure”. All I’m saying is that hackers will be trying harder. We need to be prepared.
New "Critical" nginx RCE requires LFI as prereq and has 0 practical exploitation odds - CVEs & CVSS are the biggest slop in security and AI just keeps accelerating it