It feels like the problem in this specific case is that the security people have a link to OpenAI, who have a financial interest in this being as big as possible.
PHP were right to make the warning so strict, and people were right to take sites down in precaution. It certainly could have been horrific.
However, OpenAI makes it a boy who cried wolf situation and I've no idea if "we expect to see exploits 15 minutes after the patch is launched" was a genuine concern that thankfully doesn't seem to have happened or them trying to over-state the ability of their models.
Your point is valid about how we need to be more concerned about this stuff, but I just wish it wasn't being played for bragging rights by AI guys. I mean, they had an official php2shell website ready-to-go for the patch launch party, which doesn't help it not look like a PR exercise.
PHP were right to make the warning so strict, and people were right to take sites down in precaution. It certainly could have been horrific.
However, OpenAI makes it a boy who cried wolf situation and I've no idea if "we expect to see exploits 15 minutes after the patch is launched" was a genuine concern that thankfully doesn't seem to have happened or them trying to over-state the ability of their models.
Your point is valid about how we need to be more concerned about this stuff, but I just wish it wasn't being played for bragging rights by AI guys. I mean, they had an official php2shell website ready-to-go for the patch launch party, which doesn't help it not look like a PR exercise.