[joepie91_]

I don't see what's "not true" about it. A worm vector of this scale is certainly worth the R&D investment to find exploits, and it is indeed correct to assume that the vulnerability has been found before.

Whether it has actually been used, given the value of the bug, is a different story. But it should absolutely be treated as "in active use" already, especially by state or state-sanctioned actors (like Hacking Team).

[dimino]

What's not true is that this isn't in the wild. Period. You can make all the points about urgency you want and I will agree completely, but this is not currently in the wild, as far as anyone knows. Saying it actually is being actively used would be factually inaccurate based on the information known right now.

[joepie91_]

But that's the point: as far as anyone knows - more specifically, as far as anyone has admitted.

We do not have a 100% reliable way to determine whether an exploit is known by others (and likely never will have), and as such there is only one reasonable assumption left to make: assume that it is out in the wild and known by others.

This isn't a new concept - threat modelling requires that you assume every worst-case possibility is reality, so that you can guard against it. This was formalized in the 19th century as Kerckhoff's Principle[1], and undoubtedly existed before that in military circles. This applies equally to software security.

So given that we simply don't and can't know whether it is out in the wild, the most 'correct' assumption is that it is - because that lets us protect ourselves against that worst-case scenario, which may or may not be the case.

[1] https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

[dimino]

If you think I'm arguing against the idea of treating the vulnerability like it's in the wild, then you are mistaken. I'm simply stating the fact that no one has any evidence that this is being actively used in the wild.

Are you refuting that fact, or are you not refuting that fact?