CURRENT

A critical RCE vulnerability (CVSS 9.2) has been sitting in NGINX's rewrite module since 2008, and it took an AI to find it. Depthfirst's automated security system onboarded the NGINX source code, clicked go, and surfaced a heap-based buffer overflow affecting every version through 1.30.0 plus NGINX Plus R32–R36. The vulnerable config pattern covers WordPress permalinks, PHP front controllers, and API gateways. Basically the production web. F5 has patched. A proof-of-concept exploit is already live on GitHub. And here's the truly uncomfortable detail: NGINX's celebrated multi-process architecture, where crashed workers respawn with identical heap layouts, gives attackers unlimited retries.

The average critical software vulnerability historically sat undiscovered for about five years. Five years. Patch cycles, disclosure norms, team structures, hiring plans, even the economics of bug bounties. The entire security apparatus evolved around that leisurely pace. AI just hit fast-forward on the whole system.

AI-assisted vulnerability discovery is compressing that five-year window into days and weeks
Offensive and defensive capabilities are accelerating together, but the infrastructure between them hasn't caught up
The old model assumed skilled attackers were scarce. That assumption is evaporating.
Supply chains remain the softest target, because your dependencies have dependencies, and the attack surface is everyone else's code

What's striking about this moment is the sheer density of it all. The comfortable assumption that you'd have breathing room between incidents didn't age well.

AI-assisted vulnerability discovery is compressing that five-year window into days and weeks
Offensive and defensive capabilities are accelerating together, but the infrastructure between them hasn't caught up
The old model assumed skilled attackers were scarce. That assumption is evaporating.
Supply chains remain the softest target, because your dependencies have dependencies, and the attack surface is everyone else's code

What's striking about this moment is the sheer density of it all. The comfortable assumption that you'd have breathing room between incidents didn't age well.

Security firm Calif. used an AI system called Mythos Preview to crack Apple's Memory Integrity Enforcement on M5 silicon. The exploit chains from unprivileged user to root shell on bare metal. Apple spent five years building MIE. No comment from Cupertino.

Google's Threat Intelligence Group confirmed the first known case of criminal hackers using an AI model to discover and exploit a previously unknown flaw. The attack bypassed two-factor authentication. A capability once limited to nation-states just got dramatically cheaper.

Ransomware gang Nitrogen claims 11 million+ stolen files from Foxconn's Mount Pleasant facility, the one assembling AI servers and testing liquid cooling. Confidential data from Apple, Dell, Google, Intel, and Nvidia potentially in the wild. The heart of the domestic AI hardware supply chain.

TeamPCP claims to be selling Mistral AI repositories on a hacker forum following the "Mini Shai-Hulud" attack targeting npm and PyPI ecosystems. The AI model supply chain keeps proving to be exactly as fragile as the software supply chain it inherited.

A BitLocker bypass ("YellowKey") and a privilege escalation ("GreenPlasma") from the same anonymous researcher who previously disclosed three Defender vulnerabilities. Plus a new Dirty Frag Linux kernel variant granting root access. Third kernel bug in two weeks.

Oracle is adding monthly security releases starting May 28, supplementing its quarterly patches. The stated reason is refreshingly blunt: AI-assisted vulnerability disclosure is outpacing legacy cycles. When your bug-finding tools evolve faster than your fix cadence, the fix cadence has to move.

Anthropic is in advanced talks to buy Stainless for $300M+. Stainless builds the SDKs that OpenAI, Google, Meta, Groq, and others depend on daily, with millions of weekly downloads. Separately, Anthropic is targeting a $900B valuation, more than double February's $380B.

The U.S. cleared about ten Chinese firms to buy H200 chips, but Beijing told buyers to pause. Chips must transit U.S. territory first, and China fears tampering. Jensen Huang joined Trump's delegation to Beijing today. Nobody's budging.

Final approval hearing for the largest AI copyright settlement ever. Anthropic reportedly downloaded 7 million book copies; roughly 500,000 titles are in the class. Authors can expect at least $3,000 per title. The precedent here will echo for years.

SpaceX placed a $60 billion buyout option on the AI coding tool, pre-empting Cursor's planned $2B fundraise. Whatever you thought the ceiling was for AI developer tools, multiply by thirty. The valuation conversation just changed permanently.

The two companies are in talks to build orbital data centers for AI compute. Google's Project Suncatcher targets prototype satellites by 2027. SpaceX is pitching space as the cheapest long-term option, ahead of its planned $1.75T IPO later this year. Yes, trillion.

Notion launched a developer platform for building and connecting AI agents across its workspace. Over one million custom agents built since February. Launch partners include Claude Code, Cursor, and Codex. The note-taking app keeps drifting toward something much bigger.

92% of undergrads use AI tools. 59% worry it's eroding their critical thinking. A viral essay argues higher education is producing graduates who can generate outputs without developing genuine understanding. The comments sections are predictably on fire.

Samsung's Android XR smart glasses leaked ahead of the event: Ray-Ban-style frames, $379-$499, codename "Jinju." Treasury Secretary Bessent teased a "step-function jump" in upcoming LLM releases from both Google and OpenAI. Monday could be interesting.

Friday, May 15

Friday, May 15

An AI Just Found an 18-Year-Old Hole in the Internet's Front Door

An AI Just Found an 18-Year-Old Hole in the Internet's Front Door