If I understood the timeline correctly, there was an announcement made somewhere that an RCE would be announce w/ a patch, and the internet just scanned the entire codebase, they really fumbled this for the sake of having a PR post for OpenAI.

On the other hand, I don't mind AI companies doing this sort of thing, I'm sure a lot of our internet infrastructure could benefit from these sorts of fixes and changes.

> And they botched this as someone talked. To me this looks like they used this for a PR stunt and aimed for an RCE.

This is a pretty constant theme in the infosec industry. The idea is that you want to do the "responsible" thing and let all the major, multi-billion-dollar companies patch first, so you form a secret club. But then, you share a very juicy, gossip-worthy thing with hundreds of people and ask them to sit on it for weeks. And guess what happens: they don't. Having worked for a big tech company, I've been involved on a couple of processes of this sort, and they all suffered leaks.

And rest assured, we'll learn nothing and try the same thing again next month or next year. Because what's the alternative? If you 0-day everyone, you get more hate mail, not less. It's all of sudden about you, not the vulnerable code. Microsoft or Cloudflare calls you irresponsible when asked for a PR statement, industry bloggers bully you, etc.

They haven't even been able to release the patch on time. Ubuntu still hasn't it

Wiz is owned by Google and Argon gets the main credits. So difficult to tell these days. But AI is obviously useful here.

Edit: was looking Wiz post when citation was from OpenAI

I heard this was leaked several days early and that’s why folks seem to be on the back foot.

I’d press go too - if something this big was known to some but not all…

We’ll all get through together