> If you go looking for the public record of what Mythos actually found you land on roughly 40 CVEs, and 28 of those are Firefox and 9 of them are wolfSSL. A browser and a cryptography library. There’s no PHP in that list, no CMS, nothing that resembles the web most people actually use.

How does one arrive at the idea that "browsers" is a category less representative of "the web most people actually use" than "PHP applications"?

People always cite CURL incorrectly in thier anti Mythos rants.

> Before this first Mythos report, we had already scanned curl with several different very capable AI powered tools (I mean in addition to running a number of “normal” static code analyzers all the time, using the pickiest compiler options and doing fuzzing on it for years etc).

This is why Mythos found so little: Curl is already a follows all best practices project, and they already had run scans with other leading AIs and fixed everything. The correct conclusion isn't that Mythos isn't good, it is that Mythos is only slightly better than everyone else (at the time - there have been new models since then).

If you project isn't already running all of the current best practices Mythos will find a lot - but so will everything else. If Mythos is what it takes to get you (your boss?) to take these issues serious, then the hype is worth it. You need to fix your security before you get hacked.

What do you mean by WordPress fell? What did I miss?