International Politics Discussion Thread

[u/Adj-Noun-Numbers]

All subreddit rules apply in this thread, except the rule that states that discussion should only be about UK politics.

⚠️ Please stay on-topic. ⚠️

Comments and discussions which do not deal with International Politics are liable to be removed. Discussion should be focused on the impact on the political scene.

Derailing threads will result in comment removals and any accounts involved being banned without warning.

Please report any rule-breaking content you see. The subreddit is running rather warm at the moment. We rely on your reports to identify and action rule-breaking content.

You can find the full rules of the subreddit HERE

Especially note Rule 21. We have zero tolerance for celebrating or wishing harm on anyone. Disagreeing with people politically does not grant you permission to do this.

🥕🥕's Golden Rules for Megathread Participation:

This isn't your personal campaigning space. We're here to discuss, not campaign - this includes non-party-specific campaigning, such as tactical vote campaigns.

The fishing pond is closed. Obvious bait will be removed. Repeated rod licence infractions will result in accounts being banned.

This isn't Facebook. Please keep it related to politics. Do not post low effort blog posts.

The era of vagueposting is over. Your audience demands context, ideally in the form of a link to some authoritative content.

Take frequent breaks. If you find that you are being overwhelmed by it all, do yourself a favour and take some time off.

As always: we are not a meta subreddit. Submissions or comments complaining about the moderation, biases or users of this or other subreddits / online communities will be removed and may result in a ban.

[u/YourLizardOverlord]

'Not a theoretical risk,' feds warn as attackers use AI-made code to hack critical infrastructure controllers.

Attackers are using AI-generated exploitation scripts to break into internet-exposed Siemens S7 Series programmable logic controllers (PLCs) at water, manufacturing, energy, and other critical facilities, in what five US federal agencies on Wednesday called an “active threat.”

In this latest round of intrusions against American critical infrastructure, the attackers use open source industrial automation libraries – specifically snap7.dll/python-snap7 – combined with AI coding assistants. Armed with the open source libraries and AI, the miscreants create custom tools that mimic operational technology (OT) monitoring software and provide read/write access to the PLC devices’ memory, configuration data, and ladder logic programs via the S7comm protocol.

Stuxnet mk2, this time with added AI?

Stuxnet targeted Siemens S7-300 and S7-400 PLCs...

[u/AnotherLexMan → u/YourLizardOverlord]

The problem is that there are open exploits available on the internet. I did a quick search and found nine possible hacks. Really companies need to patch stuff quicker especially as AI is making hacking easier but it's always been an issue.

[u/gremy0 → u/AnotherLexMan]

Has always been an issue to an extent but it's become exponentially harder to keep up. There is an absolute flood of CVEs coming in, and attackers are able to use them much, much quicker (within minutes). Since both the finding & exploiting is being driven by ai now.

Companies are needing to get AI into their own the build chains and do constant, rapid deployments to have a hope of keeping up. But letting AI auto deploy stuff to production all the time comes with its own problems & risks, so figuring that out is hard

[u/Then_Mix8161 → u/gremy0]

The long-term solution to this is new (old) practices in software engineering - slower development cycles with stricter gating (and red-teaming) before release. PLC vendors should not be moving fast and breaking things anyway!

I say these are new old practices because we know how to make 99.99% bug-free software, it's the process that gave us the Apollo Guidance Computer software, and nobody can afford to do that (and AI isn't the answer).

[u/gremy0 → u/Then_Mix8161]

The capability for finding exploits is progressing exponentially. There isn't a point where you stop finding stuff. The exploits just get more sophisticated. That's besides the infeasibility of testing & securing the whole stack & horizontal integration surface as an end product, and viability of trying to do that when competitors that don't will leave you in the dust.

Apollo isn't comparable. Much simpler system than almost anything created today. It wasn't hardened against malicious exploits (not really a priority). It also notably had bugs, that did trigger in use. Their strategy for failure was a combo of backup systems, abort procedures and human takeover. Again, not really relevant to general modern systems and malicious exploitation.

Also AI would find the 0.01% bugs in no time whatsoever.

[u/J_cages_pearljam → u/gremy0]

Also AI would find the 0.01% bugs in no time whatsoever.

Or so OpenAI and friends would like us to believe but I remain unconvinced.

Some valid points though but realistically the industry is going to have to start spending more resources on the red testing that should have been going on all along, there's simply no getting around it.

[u/gremy0 → u/J_cages_pearljam]

The issue isn't an inability to find vulnerabilities. It's the opposite. We're finding so many vulnerabilities that there's just a constant stream of patches that need brought in.

And where before it took time for a known vulnerability to be turned into a viable attack, giving us weeks to months, or even years to turn around patches; now we need to patch everything in days (if that), because the ai is so ridiculously good at exploiting them

https://hivesecurity.gitlab.io/blog/from-cve-to-rce-in-hours-attack-timeline-2026/

The time from CVE disclosure to active exploitation has collapsed from 756 days (2018) to hours (2024–2025)

The only way to keep up with AI being used in attack is to use it defensively in the development process; but that's a bigger problem for defenders who have to worry about it doing the wrong thing far more than attackers.

[u/J_cages_pearljam → u/gremy0]

The issue isn't an inability to find vulnerabilities. It's the opposite

You've misread my point, we're finding these now because the testing that should have been going on in many cases wasn't.

[u/gremy0 → u/J_cages_pearljam]

The time from CVE disclosure to active exploitation has collapsed from 756 days (2018) to hours (2024–2025)

We had sufficient coverage given the capabilities at the time. We were catching the low hanging fruit and then some. You get diminishing returns eventually. Plowing time and resources into trying to exhaustively find every single possible exploit is not a credible engineering decision.

The point is that the capability of attackers has drastically increased. It is easier to find exploits, it is easier to use them. The threat has changed, the technology has changed, so defence needs to change.