This is not sustainable

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

October 27th, 2026

What a week, huh? High fives all around—October is “Cybersecurity Awareness Month”, and I think we’ve all done a stellar job. If both the New York Times and NPR report on one of the at least four or five concurrent fires I’m fighting, then I think we can say that yeah, people are aware of cybersecurity. Mission accomplished, so… could we maybe turn it down a bit?

这不可持续

2026年10月27日

这周过得怎么样？大家击个掌吧——十月是“网络安全宣传月”，我认为我们都做得非常出色。如果《纽约时报》和美国国家公共电台（NPR）都报道了我正在处理的至少四五起并发火灾中的一起，那么我想我们可以说，是的，人们已经意识到网络安全了。任务完成了，所以……我们能不能稍微消停一点？

The current situation is not sustainable: 0-days are dropping left and right, pre-notifications and embargoes are broken for marketing purposes, AI companies compete first on who commits the most crimes and then pretend to sell you protection in the form of a DoS on the Open Source community. “Nice project you got there. Be a shame if somebody dropped an 0-day on it.” Companies are not staffed for this, and no matter what the industry wants to tell you, you can’t AI your way out of this.

目前的状况是不可持续的：零日漏洞层出不穷，预警和禁令为了营销目的而被破坏，人工智能公司首先比拼谁犯下的罪行最多，然后又假装以对开源社区进行拒绝服务攻击（DoS）的形式向你兜售保护。“你这项目做得不错，要是有人往里扔个零日漏洞就可惜了。”企业的人员配置根本无法应对这种情况，无论业界想告诉你什么，你都无法通过人工智能来解决这个问题。

Vulnerability discovery has fundamentally changed, disclosure processes are effectively broken, and patch management has been a losing proposition for years now. Severe vulnerabilities are identified and disclosed at a pace that defenders are unable to keep up with. This is because it still takes significant resources to accurately assess the feasibility of a given vulnerability within your environment; it takes time to discover your attack surface relevant to the given attack vector, and it takes even more time to deploy a fix. As I’ve said before, development of the fix is not the bottleneck.

漏洞发现的方式已经发生了根本性的改变，披露流程实际上已经崩溃，而补丁管理多年来一直是一项吃力不讨好的工作。严重漏洞的识别和披露速度已经让防御者无法跟上。这是因为在你的环境中准确评估特定漏洞的可行性仍然需要大量资源；发现与特定攻击向量相关的攻击面需要时间，而部署修复程序则需要更多时间。正如我之前所说，修复程序的开发并不是瓶颈所在。

Let me illustrate with examples from the last couple of days: “PwnEscape” (CVE-2026-99999) Initially disclosed as a “KVM escape”, this vulnerability also applies to other virtualization as well as containers, although that angle hasn’t really gotten much attention. You now need to assess which possible mitigations might be in place across your fleet of systems, then determine whether you can livepatch your kernels with the custom patches you pull from upstream or if you want to wait for your upstream OS provider to deliver a new kernel and then all you have to do is reboot a few thousand systems.

让我用过去几天的例子来说明：“PwnEscape”（CVE-2026-99999）。该漏洞最初被披露为“KVM逃逸”，但它也适用于其他虚拟化技术以及容器，尽管这一角度并没有引起太多关注。你现在需要评估你的系统集群中可能采取了哪些缓解措施，然后确定你是可以使用从上游拉取的自定义补丁来热修补内核，还是等待上游操作系统提供商交付新内核，然后你所要做的就是重启几千台系统。

How does AI help you here? Maybe you spend a few thousand dollars on tokens to use the most advanced cyber cyber models to develop your own exploit, but in the end, that doesn’t really tell you anything you didn’t already know, and your defensive position and tasks at hand remain the same.

人工智能在这里能帮你什么？也许你花了几千美元的代币去使用最先进的网络模型来开发你自己的漏洞利用程序，但最终，这并不能告诉你任何你不知道的事情，你的防御态势和手头的任务依然如故。