{
  "id": 4047463,
  "title": "Just a rumour of a bug is enough to find a security exploit these days",
  "url": "https://urgent.news/2026/08/28/just-a-rumour-of-a-bug-is-enough-to-find-a-security-exploit-these-days",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-28T22:12:02.000Z",
  "source": {
    "name": "Simon Willison",
    "slug": "simon-willison",
    "url": "https://simonwillison.net/2026/Aug/28/just-a-rumour-of-a-bug/"
  },
  "original_language": "en",
  "account": "A professor of computer science at Cambridge has reported that security issues in OCaml projects are being exploited within minutes of patches being shared. Anil Madhavapeddy, the maintainer of the OCaml compiler, noticed automated probes for traversal sequences in public repositories within just ten minutes of a patch being available. This rapid discovery rate is incompatible with existing open source practices for disclosing new issues. Security disclosure for rclone project has increased dramatically in the last month, with almost 50 security disclosures compared to about 20 over the past ten years. This rapid pace of discovery has caused significant strain on maintainers, with some projects requiring AI tools to triage and provide fixes. GitHub is now taking longer to assign CVEs, with assignments taking up to four weeks instead of the previous two to three days.",
  "summary": "Just a rumour of a bug is enough to find a security exploit these days Anil Madhavapeddy is a professor of computer science at Cambridge and a core maintainer of the OCaml compiler. In this somewhat alarming post he reports that security issues in OCaml projects are seeing evidence of attempted exploits within minutes of patches being shared for discussion: This normally takes a few days and a…",
  "key_points": [
    "Automated probes discovered security issues in OCaml projects within 10 minutes of patches.",
    "Security disclosures for rclone project surged to nearly 50 in the last month.",
    "GitHub's CVE assignments now take up to four weeks, compared to previous two to three days."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Lobsters",
        "title": "Just a rumour of a bug is enough to find a security exploit these days",
        "url": "https://urgent.news/2026/08/28/just-a-rumour-of-a-bug-is-enough-to-find-a-security-exploit-these-days-4057451",
        "published": "2026-08-28T20:23:15.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}