{"id":"a83c4c3b3d79bd6141874741f5b210e6b6b427ad195f7a39d6d41a62bdbdcca4","title":"The EFF argues that open-source projects need stronger support as vulnerability reports rise","argument":"The Electronic Frontier Foundation argues that a surge in reported software vulnerabilities is exposing the risks of relying on small, under-resourced teams to maintain widely used open-source projects. It says AI models helped researchers rediscover severe vulnerabilities in PHP, a programming language used to build interactive websites, and find ways to exploit them.\n\nThe post describes how a planned coordinated disclosure—a process for sharing vulnerability information and fixes in a controlled way—was disrupted by leaks and an early patch release. The EFF says this left administrators scrambling to update systems while millions of websites remained on vulnerable PHP versions. It also reports severe bugs in Node.js and GitLab and says maintainers face many reports, including some that are false.\n\nThe EFF’s central argument is that corporations should contribute to maintaining open-source software they rely on. The post connects volunteer-led maintenance with the risk that vulnerabilities may go unfixed, but does not establish how much funding or staffing would prevent future incidents. It says technical analysis of the vulnerabilities is outside the post’s scope.\n\nOpen question: How much time would it take to patch the websites the post says were still running vulnerable PHP versions, and how many would remain exposed?","topicIds":["institutions-and-trust","culture-and-authorship"],"domain":"culture","claimType":"attributed reading","limits":"The post says technical analysis of the vulnerabilities is outside its scope and refers readers to the original researchers’ analysis. The account and figures are claims made in the post; this reading does not independently verify them. The post does not quantify what level of corporate support would prevent similar incidents or how long patching would take.","speaker":{"name":"Cooper Quintin","roleAtSource":"Article author"},"source":{"title":"The Vulnerability Apocalypse and Why We Should Fund Open Source","publisher":"Electronic Frontier Foundation","format":"Article","url":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","publishedAt":"2026-10-23T15:36:46-07:00","dateBasis":"Date stated by the publisher."},"evidence":[{"text":"The EFF says AI models helped researchers rediscover severe PHP vulnerabilities and find ways to exploit them.","excerpt":"security researchers working with the latest models from OpenAI and Anthropic independently discovered the vulnerability again, and another one—and now, with a way to exploit them.","url":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","relationship":"Source-stated"},{"text":"The EFF reports that leaks and an early patch release disrupted a planned coordinated disclosure and left administrators scrambling to patch systems.","excerpt":"This sent system administrators everywhere scrambling to patch their systems before they were taken over by hackers.","url":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","relationship":"Source-stated"},{"text":"The post says that, at the time it was written, over 33 million websites were still running vulnerable PHP versions.","excerpt":"At the time of this writing over 33 million websites are still running on vulnerable versions of PHP.","url":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","relationship":"Source-stated"},{"text":"The EFF argues that corporations should contribute to maintaining open-source projects they rely on.","excerpt":"Corporations (whose products would not exist without these products) should be actively contributing to their maintenance.","url":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","relationship":"Source-stated"},{"text":"The post says maintainers face a deluge of vulnerability reports, including some that are false.","excerpt":"The small number of already overworked open-source maintainers are now facing a deluge of vulnerability reports, some of which are false, but many of which are very real.","url":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","relationship":"Source-stated"}],"sourceMedia":{"status":"found","sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","checkedAt":"2026-10-24T05:01:08.535Z","items":[{"type":"image","url":"https://www.eff.org/files/banner_library/OG-GovernmentHacking-Playpen.png","sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","attribution":"Electronic Frontier Foundation","basis":"publisher-metadata","availability":"verified","verifiedAt":"2026-10-24T05:01:08.662Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How much time would it take to patch the websites the post says were still running vulnerable PHP versions, and how many would remain exposed?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"The EFF argues that open-source projects need stronger support as vulnerability reports rise","summary":"The Electronic Frontier Foundation argues that a surge in reported software vulnerabilities is exposing the risks of relying on small, under-resourced teams to maintain widely used open-source projects. It says AI models helped researchers rediscover severe vulnerabilities in PHP, a programming language used to build interactive websites, and find ways to exploit them.\n\nThe post describes how a planned coordinated disclosure—a process for sharing vulnerability information and fixes in a controlled way—was disrupted by leaks and an early patch release. The EFF says this left administrators scrambling to update systems while millions of websites remained on vulnerable PHP versions. It also reports severe bugs in Node.js and GitLab and says maintainers face many reports, including some that are false.\n\nThe EFF’s central argument is that corporations should contribute to maintaining open-source software they rely on. The post connects volunteer-led maintenance with the risk that vulnerabilities may go unfixed, but does not establish how much funding or staffing would prevent future incidents. It says technical analysis of the vulnerabilities is outside the post’s scope.\n\nOpen question: How much time would it take to patch the websites the post says were still running vulnerable PHP versions, and how many would remain exposed?","question":"How much time would it take to patch the websites the post says were still running vulnerable PHP versions, and how many would remain exposed?","claims":[{"text":"The EFF says AI models helped researchers rediscover severe PHP vulnerabilities and find ways to exploit them.","excerpt":"security researchers working with the latest models from OpenAI and Anthropic independently discovered the vulnerability again, and another one—and now, with a way to exploit them.","support":"source-stated"},{"text":"The EFF reports that leaks and an early patch release disrupted a planned coordinated disclosure and left administrators scrambling to patch systems.","excerpt":"This sent system administrators everywhere scrambling to patch their systems before they were taken over by hackers.","support":"source-stated"},{"text":"The post says that, at the time it was written, over 33 million websites were still running vulnerable PHP versions.","excerpt":"At the time of this writing over 33 million websites are still running on vulnerable versions of PHP.","support":"source-stated"},{"text":"The EFF argues that corporations should contribute to maintaining open-source projects they rely on.","excerpt":"Corporations (whose products would not exist without these products) should be actively contributing to their maintenance.","support":"source-stated"},{"text":"The post says maintainers face a deluge of vulnerability reports, including some that are false.","excerpt":"The small number of already overworked open-source maintainers are now facing a deluge of vulnerability reports, some of which are false, but many of which are very real.","support":"source-stated"}],"limitations":["The post says technical analysis of the vulnerabilities is outside its scope and refers readers to the original researchers’ analysis.","The account and figures are claims made in the post; this reading does not independently verify them.","The post does not quantify what level of corporate support would prevent similar incidents or how long patching would take."],"mediaId":"3634c84f7d36aee199dd591b63d2034967d0d69f50413e55d37d4b7f8476d0c9","correctionReason":null,"id":"a83c4c3b3d79bd6141874741f5b210e6b6b427ad195f7a39d6d41a62bdbdcca4","publicationId":"b5e23b04-52f6-451c-8ff6-1a6489241bc3","version":1,"sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","sourceTitle":"The Vulnerability Apocalypse and Why We Should Fund Open Source","publisher":"Electronic Frontier Foundation","publishedAt":"2026-10-23T15:36:46-07:00","originalPublished":{"value":"2026-10-23T15:36:46-07:00","precision":"instant","basis":"publisher_page"},"firstObservedAt":"2026-10-23T22:41:13.423Z","createdAt":"2026-11-05T08:50:28.624Z","historical":true,"entityIds":["electronic-frontier-foundation"],"topicIds":["institutions-and-trust","culture-and-authorship"],"media":[{"id":"3634c84f7d36aee199dd591b63d2034967d0d69f50413e55d37d4b7f8476d0c9","kind":"article","url":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-10-24T05:01:08.662Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."},{"id":"6ea0d98ebf907a8d6fb607f97a49a88cab18fd12368e49b614bc46e674d8793d","kind":"image","url":"https://www.eff.org/files/banner_library/OG-GovernmentHacking-Playpen.png","sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","label":"View source image","provenance":"publisher_page","verification":{"status":"verified","checkedAt":"2026-10-24T05:01:08.662Z","method":"publisher_association_and_head","contentType":"image/png","cacheUntil":1792818368662},"recommendationReason":"Observed on the acquired publisher source; availability checked."}],"sourceMedia":{"status":"found","sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","checkedAt":"2026-10-24T05:01:08.535Z","items":[{"type":"image","url":"https://www.eff.org/files/banner_library/OG-GovernmentHacking-Playpen.png","sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","attribution":"Electronic Frontier Foundation","basis":"publisher-metadata","availability":"verified","verifiedAt":"2026-10-24T05:01:08.662Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"editorialDecision":{"outcome":"accept","reasonCodes":["useful_perspective"],"rubricVersion":"stream-admission-v5","mediaId":"3634c84f7d36aee199dd591b63d2034967d0d69f50413e55d37d4b7f8476d0c9","confidence":0.85,"provider":"vercel","model":"typesafe-ai/jev","inputHash":"e79fa36a6ad8387cd135eab90a2ca62d1cff08e9f73cc38cc51618624cb22ddc","decidedAt":"2026-10-24T05:01:09.376Z"},"provenance":{"textHash":"c812a9fb719dfe0fc731a7fa5f08bfcc9aa1c705695888cf352488b65448c897","observationId":"01f0aceb4c748d2aa3768ce933907cf2bc0d07316aa8452a11e696d6cd4eb393","retrievedAt":"2026-10-24T05:01:08.535Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"19943e1b-4121-47bd-8aad-1237861141a9"},"reviewer":{"model":"gpt-6-luna","runId":"a1200184-86e3-46f9-8cde-dae0d8c782dc"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-05T08:50:28.624Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Cooper Quintin","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Cooper Quintin","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Cooper Quintin","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","locator":"head/meta[name=author|citation_author]"},"assertionId":"9763bd4781100e455eaf9a96291bfcb19cd1d64429c4df8f8cc207318e573da3:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-10-24T05:01:08.535Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9763bd4781100e455eaf9a96291bfcb19cd1d64429c4df8f8cc207318e573da3","sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","contentSha256":"fad10bdd56d2b839b6e4da1123072d268060b0561be97c80c4d8654e718c4bec","textHash":"c812a9fb719dfe0fc731a7fa5f08bfcc9aa1c705695888cf352488b65448c897","observedAt":"2026-10-24T05:01:08.535Z"}}],"participationCoverage":{"total":1,"returned":1,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","snapshotId":"9763bd4781100e455eaf9a96291bfcb19cd1d64429c4df8f8cc207318e573da3","contentSha256":"fad10bdd56d2b839b6e4da1123072d268060b0561be97c80c4d8654e718c4bec","textHash":"c812a9fb719dfe0fc731a7fa5f08bfcc9aa1c705695888cf352488b65448c897","observedAt":"2026-10-24T05:01:08.535Z","basis":"publisher-page-metadata","sourceLinks":0,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/a83c4c3b3d79bd6141874741f5b210e6b6b427ad195f7a39d6d41a62bdbdcca4/source"}},"canonicalUrl":"https://escapemeridian.com/readings/the-eff-argues-that-open-source-projects-need-stronger-support-a83c4c3b","formats":{"html":"/readings/the-eff-argues-that-open-source-projects-need-stronger-support-a83c4c3b","markdown":"/readings/the-eff-argues-that-open-source-projects-need-stronger-support-a83c4c3b.md","json":"/readings/the-eff-argues-that-open-source-projects-need-stronger-support-a83c4c3b.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[],"entities":[{"id":"electronic-frontier-foundation","name":"Electronic Frontier Foundation","kind":"organization","context":"The Electronic Frontier Foundation advocates for digital rights through litigation, technical work and public policy.","referenceUrls":["https://www.eff.org/"],"path":"/entities/electronic-frontier-foundation","json":"/entities/electronic-frontier-foundation.json","markdown":"/entities/electronic-frontier-foundation.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"a83c4c3b3d79bd6141874741f5b210e6b6b427ad195f7a39d6d41a62bdbdcca4","revision":"b5e23b04-52f6-451c-8ff6-1a6489241bc3","revisionKind":"publication-id","title":"The EFF argues that open-source projects need stronger support as vulnerability reports rise","url":"https://escapemeridian.com/readings/the-eff-argues-that-open-source-projects-need-stronger-support-a83c4c3b"},"source":{"type":"source","id":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","revision":"c812a9fb719dfe0fc731a7fa5f08bfcc9aa1c705695888cf352488b65448c897","revisionKind":"sha256-source-text","title":"The Vulnerability Apocalypse and Why We Should Fund Open Source","url":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"a83c4c3b3d79bd6141874741f5b210e6b6b427ad195f7a39d6d41a62bdbdcca4","title":"The EFF argues that open-source projects need stronger support as vulnerability reports rise","argument":"The Electronic Frontier Foundation argues that a surge in reported software vulnerabilities is exposing the risks of relying on small, under-resourced teams to maintain widely used open-source projects. It says AI models helped researchers rediscover severe vulnerabilities in PHP, a programming language used to build interactive websites, and find ways to exploit them.\n\nThe post describes how a planned coordinated disclosure—a process for sharing vulnerability information and fixes in a controlled way—was disrupted by leaks and an early patch release. The EFF says this left administrators scrambling to update systems while millions of websites remained on vulnerable PHP versions. It also reports severe bugs in Node.js and GitLab and says maintainers face many reports, including some that are false.\n\nThe EFF’s central argument is that corporations should contribute to maintaining open-source software they rely on. The post connects volunteer-led maintenance with the risk that vulnerabilities may go unfixed, but does not establish how much funding or staffing would prevent future incidents. It says technical analysis of the vulnerabilities is outside the post’s scope.\n\nOpen question: How much time would it take to patch the websites the post says were still running vulnerable PHP versions, and how many would remain exposed?","topicIds":["institutions-and-trust","culture-and-authorship"],"domain":"culture","claimType":"attributed reading","limits":"The post says technical analysis of the vulnerabilities is outside its scope and refers readers to the original researchers’ analysis. The account and figures are claims made in the post; this reading does not independently verify them. The post does not quantify what level of corporate support would prevent similar incidents or how long patching would take.","speaker":{"name":"Cooper Quintin","roleAtSource":"Article author"},"source":{"title":"The Vulnerability Apocalypse and Why We Should Fund Open Source","publisher":"Electronic Frontier Foundation","format":"Article","url":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","publishedAt":"2026-10-23T15:36:46-07:00","dateBasis":"Date stated by the publisher."},"evidence":[{"text":"The EFF says AI models helped researchers rediscover severe PHP vulnerabilities and find ways to exploit them.","excerpt":"security researchers working with the latest models from OpenAI and Anthropic independently discovered the vulnerability again, and another one—and now, with a way to exploit them.","url":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","relationship":"Source-stated"},{"text":"The EFF reports that leaks and an early patch release disrupted a planned coordinated disclosure and left administrators scrambling to patch systems.","excerpt":"This sent system administrators everywhere scrambling to patch their systems before they were taken over by hackers.","url":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","relationship":"Source-stated"},{"text":"The post says that, at the time it was written, over 33 million websites were still running vulnerable PHP versions.","excerpt":"At the time of this writing over 33 million websites are still running on vulnerable versions of PHP.","url":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","relationship":"Source-stated"},{"text":"The EFF argues that corporations should contribute to maintaining open-source projects they rely on.","excerpt":"Corporations (whose products would not exist without these products) should be actively contributing to their maintenance.","url":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","relationship":"Source-stated"},{"text":"The post says maintainers face a deluge of vulnerability reports, including some that are false.","excerpt":"The small number of already overworked open-source maintainers are now facing a deluge of vulnerability reports, some of which are false, but many of which are very real.","url":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","relationship":"Source-stated"}],"sourceMedia":{"status":"found","sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","checkedAt":"2026-10-24T05:01:08.535Z","items":[{"type":"image","url":"https://www.eff.org/files/banner_library/OG-GovernmentHacking-Playpen.png","sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","attribution":"Electronic Frontier Foundation","basis":"publisher-metadata","availability":"verified","verifiedAt":"2026-10-24T05:01:08.662Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How much time would it take to patch the websites the post says were still running vulnerable PHP versions, and how many would remain exposed?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"The EFF argues that open-source projects need stronger support as vulnerability reports rise","summary":"The Electronic Frontier Foundation argues that a surge in reported software vulnerabilities is exposing the risks of relying on small, under-resourced teams to maintain widely used open-source projects. It says AI models helped researchers rediscover severe vulnerabilities in PHP, a programming language used to build interactive websites, and find ways to exploit them.\n\nThe post describes how a planned coordinated disclosure—a process for sharing vulnerability information and fixes in a controlled way—was disrupted by leaks and an early patch release. The EFF says this left administrators scrambling to update systems while millions of websites remained on vulnerable PHP versions. It also reports severe bugs in Node.js and GitLab and says maintainers face many reports, including some that are false.\n\nThe EFF’s central argument is that corporations should contribute to maintaining open-source software they rely on. The post connects volunteer-led maintenance with the risk that vulnerabilities may go unfixed, but does not establish how much funding or staffing would prevent future incidents. It says technical analysis of the vulnerabilities is outside the post’s scope.\n\nOpen question: How much time would it take to patch the websites the post says were still running vulnerable PHP versions, and how many would remain exposed?","question":"How much time would it take to patch the websites the post says were still running vulnerable PHP versions, and how many would remain exposed?","claims":[{"text":"The EFF says AI models helped researchers rediscover severe PHP vulnerabilities and find ways to exploit them.","excerpt":"security researchers working with the latest models from OpenAI and Anthropic independently discovered the vulnerability again, and another one—and now, with a way to exploit them.","support":"source-stated"},{"text":"The EFF reports that leaks and an early patch release disrupted a planned coordinated disclosure and left administrators scrambling to patch systems.","excerpt":"This sent system administrators everywhere scrambling to patch their systems before they were taken over by hackers.","support":"source-stated"},{"text":"The post says that, at the time it was written, over 33 million websites were still running vulnerable PHP versions.","excerpt":"At the time of this writing over 33 million websites are still running on vulnerable versions of PHP.","support":"source-stated"},{"text":"The EFF argues that corporations should contribute to maintaining open-source projects they rely on.","excerpt":"Corporations (whose products would not exist without these products) should be actively contributing to their maintenance.","support":"source-stated"},{"text":"The post says maintainers face a deluge of vulnerability reports, including some that are false.","excerpt":"The small number of already overworked open-source maintainers are now facing a deluge of vulnerability reports, some of which are false, but many of which are very real.","support":"source-stated"}],"limitations":["The post says technical analysis of the vulnerabilities is outside its scope and refers readers to the original researchers’ analysis.","The account and figures are claims made in the post; this reading does not independently verify them.","The post does not quantify what level of corporate support would prevent similar incidents or how long patching would take."],"mediaId":"3634c84f7d36aee199dd591b63d2034967d0d69f50413e55d37d4b7f8476d0c9","correctionReason":null,"id":"a83c4c3b3d79bd6141874741f5b210e6b6b427ad195f7a39d6d41a62bdbdcca4","publicationId":"b5e23b04-52f6-451c-8ff6-1a6489241bc3","version":1,"sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","sourceTitle":"The Vulnerability Apocalypse and Why We Should Fund Open Source","publisher":"Electronic Frontier Foundation","publishedAt":"2026-10-23T15:36:46-07:00","originalPublished":{"value":"2026-10-23T15:36:46-07:00","precision":"instant","basis":"publisher_page"},"firstObservedAt":"2026-10-23T22:41:13.423Z","createdAt":"2026-11-05T08:50:28.624Z","historical":true,"entityIds":["electronic-frontier-foundation"],"topicIds":["institutions-and-trust","culture-and-authorship"],"media":[{"id":"3634c84f7d36aee199dd591b63d2034967d0d69f50413e55d37d4b7f8476d0c9","kind":"article","url":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-10-24T05:01:08.662Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."},{"id":"6ea0d98ebf907a8d6fb607f97a49a88cab18fd12368e49b614bc46e674d8793d","kind":"image","url":"https://www.eff.org/files/banner_library/OG-GovernmentHacking-Playpen.png","sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","label":"View source image","provenance":"publisher_page","verification":{"status":"verified","checkedAt":"2026-10-24T05:01:08.662Z","method":"publisher_association_and_head","contentType":"image/png","cacheUntil":1792818368662},"recommendationReason":"Observed on the acquired publisher source; availability checked."}],"sourceMedia":{"status":"found","sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","checkedAt":"2026-10-24T05:01:08.535Z","items":[{"type":"image","url":"https://www.eff.org/files/banner_library/OG-GovernmentHacking-Playpen.png","sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","attribution":"Electronic Frontier Foundation","basis":"publisher-metadata","availability":"verified","verifiedAt":"2026-10-24T05:01:08.662Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"editorialDecision":{"outcome":"accept","reasonCodes":["useful_perspective"],"rubricVersion":"stream-admission-v5","mediaId":"3634c84f7d36aee199dd591b63d2034967d0d69f50413e55d37d4b7f8476d0c9","confidence":0.85,"provider":"vercel","model":"typesafe-ai/jev","inputHash":"e79fa36a6ad8387cd135eab90a2ca62d1cff08e9f73cc38cc51618624cb22ddc","decidedAt":"2026-10-24T05:01:09.376Z"},"provenance":{"textHash":"c812a9fb719dfe0fc731a7fa5f08bfcc9aa1c705695888cf352488b65448c897","observationId":"01f0aceb4c748d2aa3768ce933907cf2bc0d07316aa8452a11e696d6cd4eb393","retrievedAt":"2026-10-24T05:01:08.535Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"19943e1b-4121-47bd-8aad-1237861141a9"},"reviewer":{"model":"gpt-6-luna","runId":"a1200184-86e3-46f9-8cde-dae0d8c782dc"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-05T08:50:28.624Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Cooper Quintin","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Cooper Quintin","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Cooper Quintin","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","locator":"head/meta[name=author|citation_author]"},"assertionId":"9763bd4781100e455eaf9a96291bfcb19cd1d64429c4df8f8cc207318e573da3:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-10-24T05:01:08.535Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"9763bd4781100e455eaf9a96291bfcb19cd1d64429c4df8f8cc207318e573da3","sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","contentSha256":"fad10bdd56d2b839b6e4da1123072d268060b0561be97c80c4d8654e718c4bec","textHash":"c812a9fb719dfe0fc731a7fa5f08bfcc9aa1c705695888cf352488b65448c897","observedAt":"2026-10-24T05:01:08.535Z"}}],"participationCoverage":{"total":1,"returned":1,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://www.eff.org/deeplinks/2026/10/vulnerability-apocalypse-and-why-we-should-fund-open-source","snapshotId":"9763bd4781100e455eaf9a96291bfcb19cd1d64429c4df8f8cc207318e573da3","contentSha256":"fad10bdd56d2b839b6e4da1123072d268060b0561be97c80c4d8654e718c4bec","textHash":"c812a9fb719dfe0fc731a7fa5f08bfcc9aa1c705695888cf352488b65448c897","observedAt":"2026-10-24T05:01:08.535Z","basis":"publisher-page-metadata","sourceLinks":0,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/a83c4c3b3d79bd6141874741f5b210e6b6b427ad195f7a39d6d41a62bdbdcca4/source"}}}],"audits":[{"publicationId":"b5e23b04-52f6-451c-8ff6-1a6489241bc3","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading consistently attributes the argument, incident account and figures to the Electronic Frontier Foundation post. It does not present the post's claims as established fact or as an Escape Meridian opinion.","excerpt":"Corporations should be contributing both."},{"dimension":"summary","status":"uncertain","explanation":"The summary attributes the surge in reports only vaguely and erases the post's central AI argument: that frontier models made vulnerability discovery cheap and accessible. It omits the CVE scale and PHP's reach of about 70% of sites. It also flattens maintainer reports to 'some false', dropping 'many of which are very real.' Smallest repair: add one sentence saying the EFF attributes the surge almost entirely to AI models and claims vulnerabilities are now cheap to find. Then restore the 'many very real' clause.","excerpt":"This research is being driven almost entirely by the cybersecurity capabilities of major AI models from companies like Anthropic, OpenAI, and Google."},{"dimension":"date","status":"pass","explanation":"The originalPublished value of 2026-10-23, from the publisher page, matches the feed entry. The draft makes no conflicting date claims. The October 17 to 21 incident dates are consistent with this publication date.","excerpt":null},{"dimension":"support","status":"pass","explanation":"Each claim matches its verbatim excerpt. The limitations correctly note that the post gives no figure for how much support would be needed. The open question follows from the post's 33 million figure and its statement that patching will take a long time. No unsupported benefits, costs or forecasts are added.","excerpt":"And it’s going to take a long time to patch all these systems."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct link to the original EFF article, which is the most direct way to access the source. The alternative banner image is generic.","excerpt":null}],"createdAt":"2026-11-05T08:50:28.624Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}