PHP, TLS, etc… We appear to be facing a tsunami of vulnerabilities being discovered in record time. Further, the window to act on these vulnerabilities has basically closed to zero; hackers’ tools now automatically fold the very latest vulnerabilities into their botnets within minutes/hours of discovery. I have always been extremely reluctant to expose any of my services - even with the latest and greatest security tools. My choice to stay totally within the confines of tailscale seems vindicated given this week’s news. How are you all taking this?
Do security companies like cloudflare go back and look for past exploitation of vulnerabilities that were recently found by the public? I can’t think of any “we found this new vuln and turns out someone has been exploiting it for years” stories.
Maybe not, but maybe, just maybe, the people with these exploits aren’t running round attacking Joe bloggs personal photo album server to steal some photos, but in fact are only using the exploit very carefully and sparingly so as not to be detected, and only targeting high value and highly confidential services, where even if they were hacked or a specific exploit was deployed, either are too big to notice, or to proud to divulge the fact they lost some data 🤷