Three Buddy Problem Legal corruption, React2Shell exploitation, dual-use AI risks
5 snips
Dec 11, 2025 A Romanian documentary ignites nationwide protests, exposing the insidious nature of legal corruption and the public's demand for accountability. The conversation shifts to the growing threat of React2Shell exploitation, detailing technical challenges and the difficulties of patching vulnerable components. The hosts critique Microsoft's transparency issues and highlight the evolving landscape where advanced persistent threats meet criminal exploits. They also explore the dual-use risks of AI, questioning its rapid advancements in penetration testing capabilities.
AI Snips
Chapters
Transcript
Episode notes
Treat Vulnerable Libraries As Emergencies
- Costin proposed treating presence of vulnerable libraries as a critical emergency worth immediate remediation.
- He suggested security vendors should detect vulnerable dependencies to cut root exposure.
Automate Patching Via Platform Integrations
- Use platform providers' automated patching services (e.g., Vercel) when available to speed fixes and redeploys.
- Convert vibe-coding conveniences into automated vulnerability management where possible.
MSRC Transparency Decline Harms Defenders
- Juan and Ryan argued Microsoft has reduced transparency and community utility from MSRC, eroding trust.
- They requested actionable advisories with IOCs and detection guidance, not marketing-heavy reports.