After being downvoted for writing that this exploit is actually feasible, and me pointing out that it's just a little heap feng shui work that any agentic LLM will find out by themselves ...

Here we go, 12 hours later, end-to-end exploit of an index.php that echoes "ok" and nothing more. Pinned PHP versions, reproducible containers for each of the CVE and exploit path/killchain variants and everything.

php.ini set intentionally to defaults. max_input_vars set to defaulted value of 1000 so it's actually harder to exploit than with a higher value.

Implemented using my Exocomp agentic environment, and my post-trained Qwen3.8 27B model that I trained on reasoning traces of DeepSeek v4 Pro. All on my github, needs a single 48GB Radeon VRAM GPU for training/inference via Vulkan (before someone claims it's too expensive).

Wake up folks, your assumptions about what is hard to do and what is not is the wrong rationality here. Humans are sequential beings, therefore we think that a lot of tasks are harder to achieve. But that's not the correct metric.

Heap Feng Shui work is gruntwork, therefore LLMs are better and faster at this than any human could ever be.