It's not exactly a common situation. This is an emergency for many people. They are vulnerable and unprotected, and UNABLE TO PATCH their PHP... what do you recommend them to do?
This is MIT open source, run it through your own LLM. If you find a bug, submit a fix.
If you're paranoid, launch it as a Linux user with no access to any files. It's just supposed to proxy some network requests.
Shut down the affected services until they can install the patch. This issue is widespread enough that users will understand. Many government etc sites are affected too.
People unable to patch PHP probably aren't the same people who can be trusted to audit every piece of open source code they interact with. Even in the advent of AI.
I'm sure you have the best intentions. I still think anyone trying to fix a massive security hole by running random 10 minute old code from Github isn't really being smart about it.
https://news.ycombinator.com/item?id=50180987
[dead] ?
Oh it's been killed by someone?
What does that even mean?
Shit, some people on HN sure don't want any timely mitigations to be available.
How would that work for the OOM cases?
Out of memory?
"If you don't want to be vulnerable just install this vibecode project from a 10 minute old repo someone posted."
Doesn't really feel like it's a good way to handle security to me.
It's not exactly a common situation. This is an emergency for many people. They are vulnerable and unprotected, and UNABLE TO PATCH their PHP... what do you recommend them to do?
This is MIT open source, run it through your own LLM. If you find a bug, submit a fix.
If you're paranoid, launch it as a Linux user with no access to any files. It's just supposed to proxy some network requests.
>what do you recommend them to do?
Shut down the affected services until they can install the patch. This issue is widespread enough that users will understand. Many government etc sites are affected too.
People unable to patch PHP probably aren't the same people who can be trusted to audit every piece of open source code they interact with. Even in the advent of AI.
I'm sure you have the best intentions. I still think anyone trying to fix a massive security hole by running random 10 minute old code from Github isn't really being smart about it.