← Back to context

Comment by weird-eye-issue

7 hours ago

That's interesting because there were people complaining yesterday that this was a fully static website with no PHP involved lol

2 comments

weird-eye-issue

Reply
unsnap_biceps  7 hours ago

https://news.ycombinator.com/item?id=50234254

    OP confirmed that the server was initially serving only an index.html. In that configuration, the vulnerable code path is never reached — it requires a .php file.
    OP added php-version.php roughly 18–19 hours into the experiment (I'm not sure of the exact timing), so that period should be subtracted from the publicly displayed challenge duration.