Comment by janmo
20 hours ago
They gave too many details just by saying that it affects PHP 5 and later and is an RCE CVSSv4 9.2
This lets an AI agent look at the changes made from PHP 4 to PHP 5 and it also lets the agent guess what type of vulnerability it must be.
Are those specifics that helpful? If you're searching for vulnerabilities you can assume RCE 9.0 and you can split off 5 agents for major versions.
So what you're saying that it's only the 90% of lines of code that have been touched in the last 18 years. Yeah.
Php4 -> 5 was a massive change including zendengine2 and an overhaul of many modules. Fortunately that information really doesn't tell us much. (Also it was a year of work between the first beta and the release - many changes at that time)
I mean an agent can walk those changes, but it's close to just walking all the whole source / research from scratch at that point.
Yep. It's probably one of a handful of functions. It'll be based on request input, a script doesn't have to call the function, and it works with default configuration. I bet it takes a half hour for AI to figure it out.