Comment by pxtail
1 day ago
Mindboggling, wtf don't they release it if its ready and exploit is in the wild, its a lot of time until 14:00 UTC and a lot of websites will be breached.
1 day ago
Mindboggling, wtf don't they release it if its ready and exploit is in the wild, its a lot of time until 14:00 UTC and a lot of websites will be breached.
They should have shut up, released a new stealth PHP version and told everyone to update ASAP. They gave way to many details ahead allowing some AI agents to find the vulnerability within half an hour...
The update was withheld because releasing it without notifying major providers and distros would turn it into the same race, with ai having a release is the same thing as a disclosure.
This would've worked if other people were able to shut up about it. Because its existence got leaked they posted the announcement
Thereby throwing everyone else who isn't deemed "worthy" under the bus
There is no functional difference between doing just an announcement and doing an announcement with a series of builds containing the patch while withholding the source code. You do understand that right?
10 replies →
That doesn’t work anymore because LLMs are scanning the diffs to spot security fixes and can turn it in to a PoC as soon as the commit goes public.
Just prompt inject them with a one line comment in the fix
They'll probably release it earlier, that's what they said in the announcement in case the CVE got leaked sooner.