Second of all, the blog did add more information
"In our experimentation, exploitation of this vulnerability had high fidelity, with a near 100% success rate and can be leveraged to a full remote code execution. The attack vector is unauthenticated and remote, requiring only a specially crafted HTTP request to the target server. It affects the default configuration of popular frameworks. "
In the end - if it helped spreading the news about this risk so teams can fix them faster, then this is our end-goal with these blog posts : )
What is the "tell"? I'm not saying they are or aren't, but... people say this about literally everything now and it's typically some flimsy reasoning like "they used a bullet point". I don't see anything in particular that makes me think ai over a standard template some junior fills out.
>the vulnerability was not found by a Wiz employee at all
I've re-read the Wiz article a few times. Maybe I'm just dumb, but where did Wiz claim to have found this vulnerability?
The Wiz post has significantly changed since it was first published (and how it looked when first posted to HN), FYI -- see [1]. When it was published, it was a summary of the React announcement, and was somehow longer than the original and yet provided less useful information than the original.
In any case, the "tell" is the syntactic structure (as Chomsky would say) and certain phrases used in the post.
[0]: https://news.ycombinator.com/newsguidelines.html
[1]: https://web.archive.org/web/20251203162416/https://www.wiz.i...
What certain phrases?
(p.s. You don't need to link me to the HN guidelines, by the way. It just comes off as condescending. I'm on the site, I know where to find the guidelines, and you quoted the guideline in question verbatim. I don't understand why people do this.)
Or, … they're just citing the source for the information, so that, in case you aren't aware as to where to find them, now you are.
I think that's a doubly reasonable thing to do, given that your account is new, too.
The guidelines are linked at the bottom of every page, and directly underneath the comment box on new accounts. I also, perhaps surprisingly, know how to google "hn guidelines". Or ask chatgpt. Or reply "where's that piece of information from?".
>I think that's a doubly reasonable thing to do, given that your account is new, too.
People link the guidelines and, like, wikipedia to accounts that are 10 years old with 30,000 karma. It's a weird quirk of HN.
If you're talking to someone in real life, or professional emails, or whatever and you provide citations for commonly known things/definitions/etc.... you're being condescending.
If you're commenting on a public forum and you provide citations for commonly known things/definitions/etc., you're supplying the source of your claims for people who may be unaware. You are not the only reader of their comment (nor this one), even if it is in direct reply to yours.
[1] https://www.dictionary.com/browse/no [2] https://www.dictionary.com/browse/you [3] https://www.dictionary.com/browse/are [4] https://www.dictionary.com/browse/being [5] https://www.dictionary.com/browse/condescending
Assuming everyone is an idiot who a) doesn't know something common and b) isn't able to figure out how to google it and c) isn't able to figure out how to say "where's that from?" in a reply is condescending [6].
> Assuming everyone is an idiot who a) doesn't know something common and b) isn't able to figure out how to google it and c) isn't able to figure out how to say "where's that from?" in a reply
These things were neither assumed nor implied.
Dear jfindper,
I hope this professional email finds you well.
Would you mind reading about HN's approach to comments and site guidelines?
https://news.ycombinator.com/newswelcome.html
Please don't fulminate. Please don't sneer, including at the rest of the community.
Kind regards,
A. Webshitterpresentation and formatting aside the constant attempts to manufacture legitimacy and signal urgency are a classic tell. everything is "near-100%" reliable, urgent, critical, reproducible, catastrophic. siren emoji
I can't believe saying a security vulnerability is "reproducible", "critical", etc. is a "classic tell of ai".
I've used "reproducible" and "critical" in my deliverables since well before ai was a thing.
+ it is maybe 10% AI max, which seems to be for the structure / readability, and there is legit information under.
And because random HNer says it is ai doesn't mean it is ai.
>But still, is it so important?
Not to me, no. If the information is useful/entertaining/etc., I don't really care. But having to read "it's ai!" comments on literally every article/blog posted for the next 10 years is going to be super annoying. Especially if the reasoning provided is "they used the word critical". At least you pointed to something kind of interesting with the quotation marks (although, certainly not definitive of anything), rather than saying some extremely common word = ai.
What bothers me about the Wiz post is why they want to hide this HTTP request is actually not helpful in terms of security.
On the plus side, they help getting the word out there, so at least something.
https://web.archive.org/web/20251203162416/https://www.wiz.i...
(Note also that you can end up with mismatched quotes if you paste in a segment of text from some other source that uses them, which is pretty common in journalism for a fast-changing story.)
Mismatched smart quotes are visible in this archive.
Same way if you read an article full of typos you lose trust in it. Those tells of AI voice undermine the author and make the reader suspicious
Not for long! This seems like this will soon be the only way to put something on the internet without people rabidly saying its ai (at least for a few weeks, until people start prompting for typos to be included).
> The vulnerability exists in the default configuration of affected applications
Can be inferred from the react blog but isn't really explicit
> According to Wiz data, 39% of cloud environments have instances vulnerable to CVE-2025-55182 and/or CVE-2025-66478.
Numbers!
> Numbers!
I do not see how such numbers are useful to people reading this post.
The important part to know:
- Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.
- The vulnerability is present in versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack
- Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk.