After 7 Months, Glasswing Overwelms Maintainers with Underwhelming Findings

Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by sigmar on Tuesday November 10, 2026 @08:24PM (#50448708)

> So far, only 2 of the 442 have been exploited in the wild, just 0.45%.

> almost none are being exploited

Isn't the whole point of glasswing to patch stuff way before it can be exploited? If the patched code is distributed quickly- there's no opportunity (or incentive) for bad actors to craft and distribute an exploit. This reads like that's being spun to convey that these are "real" vulnerabilities.

[ Parent | on HN ]

Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by waynecochran on Tuesday November 10, 2026 @09:12PM (#50449020)

Exactly what I was thinking ...

    But are these vulnerabilities actually useful to attackers?

I thought the idea is that they are finding them before they are used in the wild -- how would an unfound vulnerability be useful to an attacker?

[ Parent | on HN ]

Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by oofbey on Tuesday November 10, 2026 @10:57PM (#50449585)

It’s almost as if the author thinks Glasswing should arming attackers with vulnerabilities.

[ Parent | on HN ]

Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by SiempreViernes on Wednesday November 11, 2026 @01:30AM (#50450313)

This question is a rewording of "are these questions actually high impact?", and is being asked because Anthropic said almost everything they found was high impact.

[ Parent | on HN ]

Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by shrikant on Wednesday November 11, 2026 @07:09AM (#50452494)

I see at least two more CVEs in that https://github.com/patrickmgarrity/Anthropic-Credited-CVEs repository that were most definitely "exploited in the wild" (https://www.cve.org/CVERecord?id=CVE-2026-93292 and https://www.cve.org/CVERecord?id=CVE-2026-92729) -- by virtue of being the one at my org who had to deal with it at the time. So I'm not sure what that person is basing this on.

[ Parent | on HN ]