> the attacker does not need to break in remotely. The danger is that once an attacker gets in — through a vulnerable WordPress plugin, a web shell, weak SSH credentials, or a compromised container

This part I don't understand. Wouldn't the attacker need to break in remotely? Ö

Nothing surprising there, even if 50 issues will be found in a month, since there exists more advanced relativity-based automation features as LLM.

It's easier to attack a solution with its source code available, and with an LLM trained on existing vulnerabilities found, and some datacenters/funding available, et voila, you have a system set to reveal flaws in already awesome projects, to be fixed.

This is normal. You just need power, and time. And there must be more found but left undisclosed, for better times, strategic 0days etc.

Who has such power, and funding? Is it possible Linux competitors do pay enthusiasts to attack, reveal, and damage reputation? What if someone who has funding and time, would try attacking their closed source code instead? Regardless, I wish them safety and peace, too.