Vulnerabilities Are Piling Up

Node.js, PHP, Tomcat… vulnerabilities are being reported across all kinds of platforms. As AI capabilities improve, vulnerabilities that humans would never find are now being discovered.

What I Think When I Read the News

I don't think it's humanly possible to manually patch every vulnerability that AI uncovers. But ignoring them isn't an option either — once a vulnerability is publicly reported, it's essentially a roadmap for attackers.

So what should we do? Here are some naive thoughts from a 5-year SIer engineer. Feel free to share your opinions in the comments.

AI-Powered Auto-Detection + Auto-Update

Build a system that monitors vulnerability reports for the languages, libraries, and frameworks used in your applications. When a vulnerability is detected, AI assesses the impact on the app and — if necessary — generates a fix and opens a pull request. Given that there may not even be time for a human to review the PR, it might make sense to automate deployment to a dev environment and run tests automatically as well.

The hardest part is the "if necessary" judgment. That might still require human input. Vulnerabilities with a numeric severity score like CVE are easier to handle — just set a threshold and let AI auto-fix anything above it. For non-CVE cases, it's less clear: let AI make a qualitative assessment, or have a human evaluate it?

Countermeasures for RCE

For vulnerabilities like RCE — where remote code or commands can be executed — I wonder if there could be a breakthrough at the runtime level. I don't have an answer as a 5-year SIer engineer, of course.

But I naively wonder: could we distinguish between application code and remotely injected commands? What if application code carried unique metadata, and the runtime read that metadata to decide whether execution is permitted? Could that be a breakthrough?

There might be performance concerns, but it still seems better than perpetually playing catch-up with security patches.