Hacker News Reader

Comment by echoangle | Hacker News Reader

Yeah I don’t really get this, the rumor “there is some exploitable vulnerability in php” can’t really be the problem, because that’s probably known to everyone already. The rumor only helps you exploit it if there’s some specific hint how the exploit works.

View on HN

No. https://x.com/hackinglz/status/2113025408975143080

Chainguard had a vague inkling that there was something in PHP and literally typed “find bad vulnerabilities in PHP” to a frontier model and independently discovered these.

What happens when you type the same into any other language is an exercise for the reader.

Someone leaked CVE numbers, and then someone else leaked descriptions of the PHP properties related to vulnerability itself in a blog post meta tags. Which limited the search area quite lot. And then PHP maintainers had to make announcement. That is quite different.

And they never tried this before? And no other such targets are vulnerable in the same way? That doesn’t seem very believable.

1. It has happened before

2. Even if it hadn't, some occurrence of any given event has to be the first

3. Who claimed no other targets are vulnerable in the same way?

Yeah, all targets are vulnerable. Thats the problem! Are you not paying attention?

So how do we not have 10 php situations every day? Obviously just having a rumor that php was vulnerable wasn’t the exceptional problem here, the problem was that the rumor was specific enough to find the bug because it included mitigation advice.

Haha, and he’s not the one that found it.

> Exercise for the reader. Well, if you are so confident, go do it. Share your results. I bet you won’t find a thing.

Let me ask you this: Do you believe it's possible for a passenger to do a 3G pull up in a 737 without breaking the plane or crashing?

https://en.wikipedia.org/wiki/Flydubai_Flight_1073

Since you haven't seen any commenter here on HN go out and rent a 737 and personally demonstrate it to you, it should be totally impossible right?

I guess that according to you, in today’s age, just the rumours of a passenger being able to do a 3G pull up in a 737 should be enough for people to do it. No?

Let me tell you this: - I never said VR & ED was impossible. I never said that a passenger flying a 747 was impossible either. - I said, a rumour of something so generic as “a bug exists somewhere”, does absolutely nothing for the ability to pull something off. Not before, and not now.

However, that is exactly what you wrote. Then, in your previous comment, you are changing what you said and now you’re fighting a straw man.

Goodbye dude, I’m not spending more cycles on this. Go find some bugs lol.

"A rumor" or a confirmation by the maintainers that the bug exists? Oh well, I guess you believe the that Fermat's statement of his Last Theorem had absolutely no effect on how quickly or slowly it got solved. After all, it was just a rumor. It probably had no effect at all on how many mathematicians chose to try to solve it or not.

> you are changing what you said and now you’re fighting a straw man.

Not really. I think the issue is just reading comprehension on your part. Go back and read my original comment again and see if you understand it better this time. You made a ridiculous argument, which I responded to, how is that a strawman?

> Go find some bugs lol

I still don't understand what your deal is? Why do you think I'd be interested in that? It seems like a pretty basic concept that a person can know of a thing being possible without being personally interested in doing it?

Reply on news.ycombinator.com