Hacker News Reader

Comment by letmevoteplease | Hacker News Reader

There are multiple write-ups on how the vulnerability works. The Calif one is the most detailed. Also, no one used Claude. There's a whole world of information out there when you read the original sources instead of social media distortions.

https://calif.io/php2shell/

https://www.wiz.io/blog/php2shell-php-rce

View on HN

> Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities

https://openai.com/index/coordinated-disclosure-of-critical-...

> Using Gemini 4 Argon, the team at Wiz has shown why frontier AI is a game-changer for cyber defense. For over a decade, these critical vulnerabilities remained unaddressed because vulnerability discovery and exploitation were incredibly complex.

- Raluca Ada Popa, Head of Gemini Security, Google DeepMind

See? No Claude. Never mind that other man behind the curtain

Claude is the new Hoover.

Neither of those are Claude. Checkmate.

They even did try Claude Mythos earlier in the year, and it didn't find this. There's a reason "no-one used Claude" for this now.

"Earlier this year, we worked with Alpha-Omega to scan PHP with Anthropic's Claude Mythos. But since the Mythos scan, we have added other tools, including OpenAI's Daybreak Red for validating reports and exploits, alongside sanitizer builds and reproduction environments that match our CI on every platform PHP supports."

https://thephp.foundation/blog/2026/10/21/todays-php-securit...

The fact that Mythos didnt find this is pretty damning for Anthropics claims.

> The Calif one is the most detailed. Also, no one used Claude.

be me

click link

typical ai-designed website

"it's not claude"

Is the calif website supposed to be a parody?

This is the official exploit video in the writeup - https://www.youtube.com/watch?v=pfWZrdzvooc

This is the least professional Video I’ve ever seen for anything like this. I can’t even follow what’s happening on screen.

that's the point: it essentially shows (notice the --profile-flag) the work of 2 months making the exploit work reliably on every app-php/fpm-linux-combination. The only purpose is to spread fear - and then have 50% of the internet update to a patched version with 425 changed files reviewed by ~100people and their clankers at 1400 UTC sharp while for the vast majority (using fpm like recommended for ~10years everywhere...) disabling the progress-something-flag and (optionally...) disabling multipart-uploads would have nicely mitigated this.

> disabling the progress-something-flag and (optionally...) disabling multipart-uploads would have nicely mitigated this.

I wouldn't be so sure. Many vulnerabilities have been "fixed" by blocking the particular ingress path of the demo exploit, and then it turns out that there were plenty more ways to exploit the bug, they just picked the easiest one.

Yep, perhaps turning off the feature doesn't stop the data from being parsed.

Have you tried asking Claude? Maybe we're in the age of agent-to-agent communication /s

The video looks like it's making this whole thing out to be a joke. Everything about it conveys a lack of seriousness. The dancing cartoon character, the ascii art, the music, the whiz-bang visual effects that obscure anything interesting or useful.

this video made the government websites go offline and patch their servers.

Was it parroting and cargo-culting in an unfortunate chain of events?

yes, that is the criticism.

AI generated comics for your CVEs, I can't even anymore

"Comic illustrated by Stephanie Cortes of Ibis Craft.

Poster and comic story by Michal Zalewski (@lcamtuf) of Calif."

I'm not sure if this is better or worse. Why needlessly expand the in-the-know circle for fluff like this.

well that either sucks for them or it's pathetically petty, cause it is clearly positioned in a way and on a website to look like AI slop as best as it can

if I were a serious cartoon artist, I would complain for taking the piss

Haven't you heard? The popular thing to do nowadays is to accuse someone of using AI the second anything is produced whatsoever.

Interestingly enough there are papers that suggest that AI feeding on itself will degrade output quality over time. What I've noticed from my peers is that everything produced now looks the same, and they're sick of it.

Someone had to say it:

DSHR's Blog

I'm David Rosenthal, and this is a place to discuss the work I'm doing in Digital Preservation.

Tuesday, June 30, 2026

Coprophagia Is Bad For You

https://blog.dshr.org/2026/06/coprophagia-is-bad-for-you.htm...

I do tend to disclose my use of AI, but at the same time I don't feel like I'm required to. I'm doing it to signal that my use of AI was productive, and of value to people beyond myself.

but... Calif have said that AI did find this bug.

Reply on news.ycombinator.com