← Back to context

Comment by nemothekid

1 hour ago

For me, what was strange is there were no write-ups on how the vulnerability actually worked. It really does feel like a lot of people went "Claude found a bug, and Claude says it's dangerous" but no one actually verified how exploitable it actually is? Not to say its worth ignoring, but compared to Heartbleed (where exploits had to be written by hand) there are a lot fewer active PoCs.

9 comments

nemothekid

Reply
letmevoteplease  1 hour ago

There are multiple write-ups on how the vulnerability works. The Calif one is the most detailed. Also, no one used Claude. There's a whole world of information out there when you read the original sources instead of social media distortions.

https://calif.io/php2shell/

https://www.wiz.io/blog/php2shell-php-rce

  • infinite_spin  1 hour ago

    > Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities

    https://openai.com/index/coordinated-disclosure-of-critical-...

    > Using Gemini 4 Argon, the team at Wiz has shown why frontier AI is a game-changer for cyber defense. For over a decade, these critical vulnerabilities remained unaddressed because vulnerability discovery and exploitation were incredibly complex.

    - Raluca Ada Popa, Head of Gemini Security, Google DeepMind

  • ra0x3  38 minutes ago

    Haven't you heard? The popular thing to do nowadays is to accuse someone of using AI the second anything is produced whatsoever.

    • infinite_spin  23 minutes ago

      I do tend to disclose my use of AI, but at the same time I don't feel like I'm required to. I'm doing it to signal that my use of AI was productive, and of value to people beyond myself.

    • ultrarunner  31 minutes ago

      Interestingly enough there are papers that suggest that AI feeding on itself will degrade output quality over time. What I've noticed from my peers is that everything produced now looks the same, and they're sick of it.