Hacker News Reader

Comment by rf15 | Hacker News Reader

Yes, but the same is true about LLM output. Guess there's actually no way around this than to go look yourself.

The question remains: is vanilla PHP with its default configuration easily exploitable? What are the prerequisites, and what configuration deviations are required compared to default config in the anime girl video?

I'd say yes-ish, the 9.2 rating hints that it's not a straight to-shell exploit, but still serious enough that the step is probably easy enough, imagine the DB connection string or similar leaking through the working memory leak.

The reason it's so bad is because the multipart/form-parsing by the accounts I've read happens- or begins before the PHP code is actually run, ie it's in the initial runtime stage of a request.

If core developers say "this is actually bad", don't bargain if a patch is needed. Patch it.

There is no higher authority on "this is actually fucked" other than the people that actually make that very sausage.

Patching it is painful. It needs to be done regardless.

Yes, we should all patch like every other bug - but its the CVSS score and the panic which is in question.

I think I’ve identified every device on my internal networking running php, but I’d love a reliable poc I could poc that I could run before someone starts lateral movements.

If it’s easy to exploit then it should be easy to find a POC

CVSS scores are a bad measure anyway

Yeah mentioning that a lot of nonsense has been happening with LLMs is the truth anchor that untruthful writing uses to pass through people's firewalls.

Not too dissimilar to anti-vaxx stuff or that whole other space of these kinds of dysfunctions.

You always need some kind of hook that is correct.

Reply on news.ycombinator.com