fock

but this is not what was searched for on reddit? sadly it shows. the reddit thing is beautiful, your thing is... ok compared to it.

and sadly that happens to a lot of existing opensource too...

and yet some OSS (projects not really known for 1 and 2) multiplied change velocity the last year, implementing features via what is essentially vibecoding.

If you look at that, this approach is producing a pile of slop, where one LLM implements a feature, two weeks later another LLM spots an edge case and without much human review just crams in the code to fix that. Even at 1-2 months of that, those repos have significant changes and the commit messages get weird. I wonder what happens if the LLM won't spit out a fix anymore?

Will the human maintainers who started this process because noone thanked them and noone wanted to work with them on their bright new ideas just reset to the last commit they understand? Will they drop the project? The sunk cost for them is enormous. The time-effort required to fix the mess is gargantuan already. To me it increasingly seems that after the LLM industry robbed most humans of their collective labour output it will now rob them of labour aka time as well. Some people (like you and me) seem to notice that but most just go on and essentially spend away their life on machines now. I guess the problem is that most of these people have been severely cut off from using their own agency.

and all this without vibecoding!

good to know! are these working generically against fpm with the multipart-progress disabled or against mod_php?

that's the point: it essentially shows (notice the --profile-flag) the work of 2 months making the exploit work reliably on every app-php/fpm-linux-combination. The only purpose is to spread fear - and then have 50% of the internet update to a patched version with 425 changed files reviewed by ~100people and their clankers at 1400 UTC sharp while for the vast majority (using fpm like recommended for ~10years everywhere...) disabling the progress-something-flag and (optionally...) disabling multipart-uploads would have nicely mitigated this.

(POV when storing 1PB in Oracle) when I saw the 10 TB in another post, I was like "wait, isn't this sold to scale out, we have 100 times the data here".

and they also have plenty of exposure to their motherships burning money on LLMs

oh, so you say they only sat on it for a week? And then they exhaustively searched all exploit-paths so they have a demo ready 2 months later?

yes, they sat on a working exploit for 2 months to hone their magic "this exploits everything"-script. In other words: criminals.

did I skim this correctly that with the mitigation shared this does not (yet) impact fpm-usage and classic CGI (vs. mod_php) is not impacted either?

it's a shared host? So the hoster should have shut it down?

you could just use a MAC-framework? like recommended for years...

yeah so let's go an jail Elon, Dario, Sam and their gang. Or go to a no kings-demo and let them take over...