Sloppy security keeps embarrassing big names

Microsoft shipped a remote code execution vulnerability in MS Paint, fixed in version 11.2609.401.0, and the first reaction was disbelief that it wasn't a joke. A researcher published hardcoded credentials and other flaws in Tata Motors' app, with the company saying it was fixed and no data leaked, and a commenter replying 'par for the course' with a link to an earlier Tata hack. Pwn.college hit the front page and got hugged to death, a sign of how much appetite there is to learn offensive security. An old FCC thread on IoT update rules shows the same worry: nobody trusts vendors to patch.

The pattern: the incidents aren't exotic. Hardcoded secrets, forgotten attack surface in a legacy utility, and apps shipped without review. Meanwhile AI coding agents are producing more code faster, which makes the review gap wider, not smaller.

Company statements of 'fixed, no evidence of leaks' are treated as noise by commenters unless logs are shown.