undefined | Better HN

0 pointsthree_burgers6h ago0 comments

CVE-2026-28952 is about an integer overflow due to lack of input validation. I wonder what makes such vulnerability difficult to discover by traditional SAST tools?

0 comments

firesteelrain5h ago

Fuzzing, dynamic analysis or DAST might have found it too.

Assuming Apple has deployed all of these and have invested in the labor/training on how to properly use them.

pbgcp2026new16m ago

... because it was vibe coded by someone in ... other country. Cut the corners, deliver fast! Consume tokens!

tptacek2h ago

Then why didn't they?

kimixanew6m ago

I think the real point is they didn't - until it became a "marketing" thing for another company who did it for them.

A lot of these issues would be highlighted by "legacy" (pre-AI) analysis tools. The issue is that they weren't being run.

j / k navigate · click thread line to collapse