letmevoteplease
Joined 8 years ago
Joined 8 years ago
Meanwhile, look back at the old Mythos and Glasswing threads and all of the AI haters on Hacker News were lambasting Anthropic for hyping up the next token generators that could never find a bug not in their training data...
Calif: "the available exploitation paths depend on the PHP version and SAPI but are always exploitable under default configurations" ... "This results in RCE against arbitrary PHP scripts on Apache mod_php and PHP >= 5.4.0."[2]
PHP Foundation: "full remote code execution was demonstrated with default settings."[3]
Unless all of these organizations are lying, the exploit can work against a default PHP installation running a Hello World script.
[1] https://www.wiz.io/blog/php2shell-php-rce
[2] https://calif.io/php2shell/
[3] https://thephp.foundation/blog/2026/10/21/todays-php-securit...
[1] https://sumsec.me/2026/liang-wenfeng-investor-meeting-transc...
The rest of the analysis seems to take it for granted that we have hit a wall and LLMs will improve no further. OK. We'll see how that prediction plays out.
[1]https://research.skeptic.com/content/files/2025/02/Research-...