Comment by bramhaag
9 hours ago
Took them almost 7 years even. According to the Calif write-up it was already reported in 2019 (https://bugs.php.net/bug.php?id=78876) and 2024 (https://ostif.org/php-audit-complete/).
9 hours ago
Took them almost 7 years even. According to the Calif write-up it was already reported in 2019 (https://bugs.php.net/bug.php?id=78876) and 2024 (https://ostif.org/php-audit-complete/).
Lol wait so OpenAI's LLM to discover this vulnerability most likely just looked it up in an old forum post?
This isn't a terribly uncommon method of 'discovery'. In maths and sciences there have been tons of papers that have highlighted something new but were never really connected to anything else and then largely forgotten. Later they are picked up by someone else and connected to a much bigger whole.
It's only one piece in the full exploit chain.
That's what my agent did to find a UAF. It just took a public one from calif off the internet and found it still flagged asan.
[flagged]
That's how 90+% of script kiddy -type hackings happen, isn't it. That or publically available databases without a password.
AI is gonna make our stuff pretty robust, eventually. The transition phase might hurt a bit.
The bug you posted was patched and fixed 6 years ago, and none of the other bugs in the audit showcase that issue. Are you sure these are the right links?
No way to prevent this, says only language where this regularly happens
Criticals happen in other languages all the time. You are seeing this with PHP in the news because it's used on 70% of the Internet.
https://fedi.katze.sh/@elise/117479383739450605
¯ \ _ ( ツ ) _ / ¯
LOL
PHP will always be the slop before AI.