Comment by airtnp

13 hours ago

Ok, based on my reads on Wiz and Calif writeups, there are 5-6 issues mapped to 2 CVEs.

Wiz (with GPT 5.6 Sol + Gemini 4 Argon) : Remote process-memory disclosure; OPcache type confusion; Fatal-error backtrace UAF. POC on Wordpress, Drupal and Joomla

Calif (with LLM, no specific model, but model is accessible to all): Zend HashTable OOM. Targets PHP-FPM and mod_php.

Both discovers the UAF on upload progress unserializer.

Surprised to see the anime girl dancing with POC is really uploaded by Calif researchers.

32 comments

airtnp

Reply
chuckadams  12 hours ago

Both of them memory safety issues. C is just not fit for purpose in this decade.

  • rbanffy  11 hours ago

    C is not to blame for programmers using its features unwisely and, as a result, writing buggy code. Writing secure C code requires discipline, and, most likely, keeping yourself limited to a subset of the language.

    This is why languages like Rust have their place - their compilers impose the discipline and the restraint C doesn't. It's not impossible to write code with memory safety issues in Rust - it's just a lot harder. I remember saying the same about Java - it doesn't make writing the program any easier, but it makes writing some bugs difficult.

    • kstrauser  11 hours ago

      > C is not to blame for programmers using its features unwisely and, as a result, writing buggy code. Writing secure C code requires discipline, and, most likely, keeping yourself limited to a subset of the language.

      It sure is to blame. Evidence shows you need wisdom, discipline, and an impossibly high bar of encyclopedic knowledge of every feature of C and all common libc's combined with an inhuman perfection of never once making a single typo, and a vast amount of tooling to analyze the code and find some of the bugs that made it through anyway.

      The best, most trusted, most accomplished C programmers I could name still have a track record of writing vulnerabilities triggered by C footguns, not just garden variety logic bugs that could affect code written in any language. Can I write more diligent C code than the OpenBSD team? Than the Linux devs? Than Fabrice "I made everything" Bellard? Not a chance, but C has bitten each of them. Us mortals don't stand a chance.

      2 replies →

    • KingOfCoders  10 hours ago

      "Writing secure C code requires discipline"

      Ah the old, you're using the tool wrong.

      Yes, perhaps, although a tool that no one seems to be able to use correctly, see kernel bugs, zero days everywhere, bugs in cURL by people who seem very rigorous and thorough, in google and microsoft products, etc. I'm not sure the tool is innocent in this. If the highest paid C developers in the world can't use it, who can?

    • cowlevel  11 hours ago

      Yes and no. I'd say there's nothing wrong with C - it's not evil - but maybe we still shouldn't use it because we should demand things C doesn't provide. There's nothing wrong with assembly code either but we rarely use it.

      1 reply →

    • chuckadams  11 hours ago

      > C is not to blame for programmers using its features unwisely

      "Make no mistakes" works about as well for humans as it does for AI, and we have decades of lived experiences to draw on for that verdict.

      4 replies →

    • UncleMeat  5 hours ago

      What we have learned over the past many decades is that no amount of discipline solves this. It does not matter how world class your team is. Complex C programs that process untrusted input have security vulnerabilities.

    • echelon  10 hours ago

      C allows you to express things easily which should not be easily expressable. When people do these things it is almost always in error.

      That is the fault of the language.

processunknown  12 hours ago

Whats the issue with the POC video? I dont understand why thats surprising