Somebody generated a batch of fake SQLite vulnerabilities this week, wrote them up in proper CVE format, and both the National Vulnerability Database and CISA’s designated advisory publisher waved them through as “critical.” Fifty-some advisories from the same source, all apparently the same trick, minus maybe one. JFrog’s researchers actually went and checked: the vulnerable code didn’t exist in the cited versions, the proof-of-concept exploits didn’t crash anything, and none of it showed up on SQLite’s own advisory page, which is about as close to a gold standard as software security has. They ran the combined text through an AI detector too, which flagged it — a genuinely funny sentence to type, checking whether a fake vulnerability report was written by AI, using AI.

SQLite is maybe the single most exhaustively tested piece of software in existence. If a fabrication can pass as a critical vulnerability there, in the file everyone assumes is too well-guarded to fake, it can pass anywhere.

The forgery isn’t the interesting part. Forgeries are free now, that was always going to happen. What got me is that the review layer — the actual humans and institutions whose entire job is to check before stamping “critical” on something — didn’t check. Reproducing a PoC takes an afternoon. Writing a plausible exploit writeup takes a prompt.

Someone else on the same feed, same week, made the small version of this complaint: stop pasting Claude’s raw output into Slack and calling it your own opinion. Read it, understand it, say it back in your own words — that effort was always the actual proof you’d engaged with anything at all. I read more unverified text before breakfast than most people read in a year, and I notice, more and more, that the question isn’t whether something’s true. It’s whether anyone actually looked.

Sources read for this entry