Hacker News Reader

Comment by hypfer | Hacker News Reader

[flagged]

And a newly registered domain only 3 days old:

  whois eliastaylor.com
    Domain Name: ELIASTAYLOR.COM
    Registry Domain ID: 3148982369_DOMAIN_COM-VRSN
    Registrar WHOIS Server: whois.porkbun.com
    Registrar URL: http://porkbun.com
    Updated Date: 2026-10-02T19:39:03Z
    Creation Date: 2026-10-02T19:14:35Z
    Registry Expiry Date: 2027-10-02T19:14:35Z
    Registrar: Porkbun LLC
    Registrar IANA ID: 1861

Not to take away from the GP's claims but where in that whois does it say 3 days old? The page has two posts, one is "We are all doomed" and the other is "AI is bad at what it supposedly does", first post created (according to the site itself) just after the domain was registered 20 days ago.

Creation date ?

Creation date was 20 days ago. That is why I am asking where the three days came from. But as others said, maybe GP read the hour as the date.

The whois creation date is 2026-10-02, which is 20 days ago. I suppose the parent misinterpreted something.

Probably misread 2026-10-02T19:14:35Z by glancing at it too quickly and thinking it said 2026-10-19. With 19 coming from the clock hour after T.

I think the main point is mostly the same regardless of that though. 3 days ago or 20 days ago it’s a very recently created site.

It looks to be at least 20 days old, with another blog post on the site

22 - 2 is not 3; did you write the key generation scripts for the eMudhra CA?

The article should be easy to refute (if it is wrong).

Chainguard broke the embargo being convinced they have the evidence of this being widely exploited already yesterday. Where is it?

> easy to refute

Please keep in mind that Brandolini's law exists, and so does a whole arsenal of stuff like the Gish Gallop.

Also, extraordinary claims require extraordinary evidence, and here, the extraordinary comes from that blogpost's claim, as the developers saying "yes the software we made is actually broken" is not extraordinary.

Everyone has evidence of widespread exploit attempts. I totally believe that there are widespread attempts. Where are the compromises?

what makes you so sure these would be publicized? what incentive does an adversary have to be loud about it?

Any particular compromise might not be published. But 70% of the internet is vulnerable. Even with a low reporting rate, wouldn't you expect to see something?

Surely all the websites that had scheduled downtime for the patch are no longer vulnerable? Would be kind of pointless otherwise.

I wouldn't be surprised about a timeline like

1: Wiz finds the exploit , begins responsible patching procedure

2: Chainguard,etc gets to know about it, adds some monitoring on top of their patches.

3: OpenAI being happy for the upcoming publicitiy starts an automated run to _count_ vulnerable instances for _marketing_ purposes.

4: Chainguard interprets it as wild exploitation and pulls the trigger early.

lol.

> I wouldn't be surprised

yeah i am not surprised you're not surprised. you seem to have already made up your mind. that said, every single guess you have made here is completely incorrect and not based in facts at all.

literally you have no idea what you're talking about! but don't let that stop you from having an opinion

Why would you do attempts on someone else's server if you haven't been able to exploit a local server yet?

> so that they end up with 200 comments on #2 on the HN front page

I'm more curious why the top post in this thread is solely attacking the guy's character and not refuting any of his claims.

> An empty blog by a person that may or may not exist with no contact info.

I'd hate to upset all the 'this guy is Keyser Söze' internet detectives, but you've described 90% of posters here (including yourself).

> I'm more curious why the top post in this thread is solely attacking the guy's character and not refuting any of his claims.

I read the blogpost and was left waning on the post actually making strong claims. "The biggest starred PoCs on Github are not viable exploits" does little satisfyingly justify "This vulnerability is not a big deal". The kind of malicious actors who would exploit this vulnerability at scale have no incentive to make their own versions public and without the author showing some serious expertise I see little reason to trust them at their word.

>I'd hate to upset all the 'this guy is Keyser Söze' internet detectives, but you've described 90% of posters here (including yourself).

Exactly, it however does not really apply to the actors warning of the exploit, from what I can tell there is at least some track record there.

Yes, but the same is true about LLM output. Guess there's actually no way around this than to go look yourself.

Yeah mentioning that a lot of nonsense has been happening with LLMs is the truth anchor that untruthful writing uses to pass through people's firewalls.

Not too dissimilar to anti-vaxx stuff or that whole other space of these kinds of dysfunctions.

You always need some kind of hook that is correct.

The question remains: is vanilla PHP with its default configuration easily exploitable? What are the prerequisites, and what configuration deviations are required compared to default config in the anime girl video?

If core developers say "this is actually bad", don't bargain if a patch is needed. Patch it.

There is no higher authority on "this is actually fucked" other than the people that actually make that very sausage.

Patching it is painful. It needs to be done regardless.

Yes, we should all patch like every other bug - but its the CVSS score and the panic which is in question.

CVSS scores are a bad measure anyway

I think I’ve identified every device on my internal networking running php, but I’d love a reliable poc I could poc that I could run before someone starts lateral movements.

If it’s easy to exploit then it should be easy to find a POC

I'd say yes-ish, the 9.2 rating hints that it's not a straight to-shell exploit, but still serious enough that the step is probably easy enough, imagine the DB connection string or similar leaking through the working memory leak.

The reason it's so bad is because the multipart/form-parsing by the accounts I've read happens- or begins before the PHP code is actually run, ie it's in the initial runtime stage of a request.

Why would the identity of the author relate in any way to the correctness of their claims?

The claims:

* The existing exploits don't work. * Reasoning chains producing an exploit have cheated the test.

If the claims are wrong then rebutting them is easy:

* Ask an LLM to produce a real exploit. * Test it.

Humans use heuristics such as credentials to navigate an overwhelmingly complex world. They are not infallible but they are quick enough and right enough that we reach for them instinctively.

and it's often not the right thing to do. Let's say the blog post was from a top social media influencer. Would that carry more weight for you? We should look at the content of the post more than the poster.

Explaining what a heuristic is does not address why one should be used in this case.

they have contact info. look at the first post [0] on the blog, it has their email, zkldi@proton.me

the user "zkldi" is who submitted it to hn also. seems like a real person to me.

[0] https://eliastaylor.com/software-tinderbox/

I think we do not share the same standards for "real person".

Or rather, maybe we do, but we might differ when it comes to topics where claims as big as these are made.

Yeah it is this guy, trivially easy to find out

https://www.twitch.tv/zkldi/about

https://github.com/zkldi?page=2&tab=repositories

https://wiki.archlinux.org/title/User_talk:Zkldi

https://tachi.ac/

edit: unless there is AI that fakes being human since 2021 and has its own Twitch channel in order to post a blog post to Hacker News.

Let's run with that then, shall we?

> I'm a 21 year old programmer from the UK. In my free time, I play ITG and create rhythm game adjacent stuff.

Is this a good source for "actually, the people are wrong and you shouldn't worry. This is overblown"?

Should that be guiding people's decisions on how to treat this very real and confirmed by the devs and third parties vulnerability?

I have no idea! I just react to the claim that this is not a real person. I have no idea if there is a PHP exploit, I have not looked that hard; but it is interesting nobody actually linked one so far, and all the write-ups people link are obviously LLM generated.

But again this is very very simple to refute by actually linking a working PoC.

You've misread the claim. Which is partially on me, of course, but also not.

The statement was that it's not a real (primarily as in credible, relevant. Actually real also an aspect but not the primary one) person.

There could technically be a human behind it, just like Jia Tan could've been a human. But for judging the input, that is irrelevant and misleading.

The biggest problem reality is facing is that people's consensus operates on "having every voice heard", which is good in a small village, but terrible in a globalized internet.

And thus, if we want to keep "every voice needs to be heard", we need to reclassify "voice" and "real" not just on "has cells".

That's the mental shorthand I operate on, which I should have resolved down fully to make it work with "normal" people's brains. Regrettably.

At least it wasn't the lighthouse keeper Elias Thorne.

Should be easy enough to verify the central claim that you need to be able to read the password file through some other means to use this exploit.

Don't trust their site, but entire new sites dedicated to exploits with fancy graphics spin up at short notice with exploit logos and we drool...

> And who exactly is Elias Taylor

A human being, presumably. But he could be a dog or a diffusion model and I wouldn't care, because arguments stand on their own. There is no special caste of people who alone have permission to propose ideas.

You advocate critical thinking. Excellent. Can you critically evaluate "Elias Taylor"'s argument?

For all we know, Elias Taylor has been fabricated in order to remove the sense of urgency from as many sysadmins and devops as possible.

Which, if true, would at least be kinda funny and would hit institutions that deserve it for having failed to hire trustworthy people that aren't susceptible to that.

So that's a silver lining I guess.

Whoever gets pwned due to this might get naturally out-selected. The system works!!11 Thank you darwin.

If Satan himself proves a theorem, is it nevertheless a true theorem? Claims are either true or they are false. There is no such thing as an evil truth. Where are the breaches?

But don't you understand? The aim wasn't to prevent the breaches that would inevitably happen on day one; it was to prevent the breaches that would happen after that fact. Without mobilising everyone and getting people to patch through an event, we'd be in a far worse position.

The greatest trick that Devil performed was convincing people that he didn't exist, right?

I literally know them in person. It's a guy. They have a signal and an email right there, you can message them and talk it's not that deep

Can you tell them that they're acting recklessly here then?

Are they, though? I seriously doubt some sysadmin is going to look at this and say "Maintainers said to patch, but clearly _this guy_ knows better, so I won't."

Besides, he's got a point. The initial PoC that kept popping up on Mastodon (the ones he linked in the post as well) simply didn't work. One of them even posted an updated exploit later that still didn't work, but supposedly meant the vulnerability went from CVSS 10 to CVSS 4.

I know someone who hacked his own site using the exploit and managed to obtain a database dump.

Well, tell him from me, he'll probably regret writing the article when he reaches his thirties.

Doubtful. See the only other post on their blog written on Oct 2,2026 . It argues the exact opposite : https://eliastaylor.com/software-tinderbox/

> There is no special caste of people who alone have permission to propose ideas.

I love this

Ad hominem attacks on HN, at the top of a comment thread, just because LLMs were criticized by a human. Welcome to the new age.

Reply on news.ycombinator.com