unpatched

It makes me wonder how many other known unpatched exploits like this are out in the tall grass.

There are unpatched 0-days that go back years that still make WinXP dangerous to have on any sort of network.

Bug fixes from Valve are few and far inbetween with many bugs being unpatched for years.

Each and everyone depends on the same software bugs being unpatched and kept a secret.

Both systems have unpatched root exploits if you have access to the display subsystem.

What's insecure is user behavior when they keep running old, unpatched versions of software.

Having containers able to package weird obsolete (unpatched) applications, specific (out-of-date) versions of libraries, and poorly-written homespun code is a recipe for exploits.

If the Dutch logistics companies were running unpatched versions of Windows (for example) that seems more like an operations failure than anything else.

As a brute-force approach, perhaps you could send the video through otherwise identical patched and unpatched emulators and compare post-playback memory and filesystem states?

With something like this a cluster admin could find all the containers across a 10k node cluster are running an unpatched version of openssl.

Every OS that people actually use has boatloads of unpatched security issues.

The two researchers say that even if their code makes it easier for malicious hackers to attack unpatched Jeeps, the release is nonetheless warranted because it allows their work to be proven through peer review.

They said "this product will likely have unpatched vulnerabilities in the future" because it will likely have unpatched vulnerabilities in the future.

Only when used in tandem with a Windows exploit: "A spokesperson for Google confirmed that attackers could evade the Chrome sandbox by using the Flash exploit in tandem with another Windows vulnerability that appears to be unpatched at the moment."

"The two researchers say that even if their code makes it easier for malicious hackers to attack unpatched Jeeps, the release is nonetheless warranted because it allows their work to be proven through peer review." Their justification for releasing their code, as someone who works in peer reviewed industries is weak and they clearly are prioritizing attention over security at this point.

The main comparison at that level is the unpatched server running in the basement of a business somewhere - or indeed the "roll your own" where it gets updated once every few months if the person running it remembers and isn't on holiday at the time...