Hacker News Reader

Comment by bramhaag | Hacker News Reader

Took them almost 7 years even. According to the Calif write-up it was already reported in 2019 (https://bugs.php.net/bug.php?id=78876) and 2024 (https://ostif.org/php-audit-complete/).

View on HN

Lol wait so OpenAI's LLM to discover this vulnerability most likely just looked it up in an old forum post?

That's what my agent did to find a UAF. It just took a public one from calif off the internet and found it still flagged asan.

This isn't a terribly uncommon method of 'discovery'. In maths and sciences there have been tons of papers that have highlighted something new but were never really connected to anything else and then largely forgotten. Later they are picked up by someone else and connected to a much bigger whole.

It's only one piece in the full exploit chain.

That's how 90+% of script kiddy -type hackings happen, isn't it. That or publically available databases without a password.

AI is gonna make our stuff pretty robust, eventually. The transition phase might hurt a bit.

The bug you posted was patched and fixed 6 years ago, and none of the other bugs in the audit showcase that issue. Are you sure these are the right links?

No way to prevent this, says only language where this regularly happens

Criticals happen in other languages all the time. You are seeing this with PHP in the news because it's used on 70% of the Internet.

https://fedi.katze.sh/@elise/117479383739450605

¯ \ _ ( ツ ) _ / ¯

Sure, but this particular vulnerability could not have happened in a language like Rust.

LOL

PHP will always be the slop before AI.

Reply on news.ycombinator.com