Systems still take some effort to actually exploit. For example, the vast majority of bugs they found here are local privilege escalations, and most security people have long learned that user separation in the kernel is not a particularly strong security boundary. Network-exploitable vulnerabilities are a lot rarer, and it's noteworthy that there have been a few big ones discovered recently, but it's a much smaller number overall.

In general computer systems have been known unreliable since the 1980s, especially when networked. The entire cyber security industry operates not by preventing intrusions in the first place, but by rapidly mitigating them when they inevitably happen.

Hopefully this type of work to automatically discover & patch vulnerability leads to much more reliable software, and the remove the need for cyber security.

It is effort & probability game, and very often lack of information is the only advantage - security by obscurity. Even completly unplugged system probability of security breach is higher than zero, as somebody with enough determination can breach the physical place security protections and just sit at the machine and turn it on.

The governments buy them up [1]. Nukes wouldn't be required for WW3.

[1] https://www.cyberdefensemagazine.com/zero-day-market-the-gov...

Just in the last month multiple governments had to shut down important online services due to a PHP vulnerability, and seven EU countries have had disruption to their food supply after millions of dollars' worth of it was cooked in hacked fridges. We aren't at existential yet, but we seem to be getting there.

Not sure about this case but seems many of the vulns reported require physical access. At that point the vuln is irrelevant anyhow, your target is cooked a thousand different ways.

Because critical systems are mostly not accessible from the open internet

Cybersecurity operates under the "not enough bears" theory of security. There are a million people in a valley and a male and female bear. You do not need to outrun the bears, you just need to outrun the two slowest people. Next year there are more bears, but you still only need to outrun a few people. Then, one day, there are a million bears and they eat you all. But that day has not happened yet.

To explain more seriously, almost all visible cyberattacks are carried out by profit-motivated criminals. This has a very clear cost-benefit analysis; your revenue is hacking organizations and extorting them for available money, and your costs are developing and deploying attacks. The ROI is outrageously good easily being on the order of 10x to 100x. If it is so easy and so profitable why do not they just hack all of the millions of organizations on the planet with millions of dollars of available cash for trillions of dollars of revenue? Sure, all they have to do is create a trillion dollar revenue commercial organization bootstrapping themselves with no outside investors, loans, or access to financial resources or the financial system.

I mean, it took Mark Zuckerberg 20 years and a metric ton of VC investment and public investment to make 200 billion dollars in revenue. So what kind of loser can not make a commercial organization 5x larger with a trillion dollars in revenue in less time with no outside investors? Are they even trying? Just make more revenue than any other commercial organization in the entire world and extract that money in a freely usable form, how hard can that be?

They are not there yet, but they are trying. If you look at cybercrime reports you see something like 3x-10x growth year over year. Ransomware reports from a few years ago were showing a 3x year over year growth in number of attacks and simultaneously a 3x year over year growth in ransom amount with the averages being on the order of 100,000 dollars. Chump change for any serious organization, but give that a few years of 3x and that starts to look like real money. However, as it becomes real money it becomes harder and harder to launder it into a usable form. Sure, you could hit someone for 30 million dollars, but how are you going to get that into your bank account? Cryptocurrency helps some, but even there the big money tries to steer away from large overt crime. Maybe you could launder a few tens of billions a year that way, but that is still a far cry from the trillions for everything everywhere.

And of course even assuming you can scale your organization 10x year over year it still takes a decade of sustained growth, scaling your hiring and organization across 9 orders of magnitude, to get to billions per year. A literal decade even if you were growing at a outrageous pace for a outrageous amount of time just to reach a fraction of the total addressable market. A decade of that and you are still nowhere near blowing up all the power plants. Give it time, we need a lot of bears to get there.