Comment by giancarlostoro
9 hours ago
If I understood the timeline correctly, there was an announcement made somewhere that an RCE would be announce w/ a patch, and the internet just scanned the entire codebase, they really fumbled this for the sake of having a PR post for OpenAI.
On the other hand, I don't mind AI companies doing this sort of thing, I'm sure a lot of our internet infrastructure could benefit from these sorts of fixes and changes.
After the HN post came up, one security firm included "session.upload_progress.enabled", "session.use_strict_mode", and "php-fpm" in the SEO tags for their initial disclosure that a vulnerability existed. I imagine this was a good hint. https://web.archive.org/web/20261021005246/https://sansec.io... https://x.com/its5q/status/2112700519261032497
The somewhere was a loser on this very website https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/
This post reads like pure slop to me
Honestly, who cares at this point?
The slop announcements are getting more annoying than the slop.
1 reply →