Hacker News Reader

Comment by qudat | Hacker News Reader

> There are now multiple posts from vuln research teams all of whom have working RCE POCs against unmodified PHP applications.

pics or it didn't happen

View on HN

Wiz (subsidiary of google) claims to have a working exploit: https://www.wiz.io/blog/php2shell-php-rce. Calif has as well: https://calif.io/php2shell/. Calif even posted a video demonstrating the exploit (subsequently removed)

Show me the code.

This is such a conspiratorial mindset. This very forum thread is packed with people providing code and confirmation of working exploits. Leading security organizations have confirmed RCE exploits with video and provided detailed writeups of how the bug works. The PHP maintainers coordinated the release. The government is involved.

This is exactly the issue from earlier on.

I also think people want to check it with a vanilla install, not with "poorly configured servers" etc.

I've seen a bit too much (early on, ive not checked anything in the last 12 hours) saying "exploit confirmed", no one is disputing that, just its efficacy - specially after the hype and vanity sites.

Is the confirmation of a Google subsidiary, coordination from multiple government security agents and the word of the PHP developers not enough for you? Why not? Why is your bar of proof set so high? The downside of not reacting is far worse than the downside of reacting yet you seem to be suggesting under reacting would be superior?

Because the other part of "show me the code" quote is "talk is cheap".

Talk is cheap, yes. Which is why the working exploits from Wiz, Calif and the PHP team were rather more useful than another demand for a private demonstration.

Some people hate AI so much that they start to deny facts that don't suit their narrative. If this had been found by a human being then they wouldn't be contorting themselves to try and deny it exists. Many people feel incredibly threatened by AI. It seems to inversely correlate with competence in my experience.

You are making a connection that doesn't exist to fit in your narrative

I think you're correct that people are trying to deny facts. However, I also believe your assertion of their beliefs is inaccurate.

History proves that new technology makes people twitchy in every direction. My anecdotal memory of X-rays is entertaining (we can use them to beam knowledge into brains!) and apocalyptic (X-ray guns will make warfare terrible!).

I have a rule for everything: the information is valid in inverse proportion to its political value. This is a bad exploit, and it happens from time to time. There's also an IPO connected to AI that is very political for many people who threw a lot of money at it.

Unfortunately, the AI hypesters have made us a low trust society.

See, this is the problem with this post. At this point, and in the absence of a public exploit people can play with, it's more fun to do the truther debate about the vulnerability than to assess the situation soberly, and the First Law of Message Boards thus dictates the discussion will be dominated by truther debates.

> in the absence of a public exploit people can play with, it's more fun to do the truther debate about the vulnerability

I don't think anybody is asking for the code, but it would be nice to see the claims of working exploits that you're referring to.

A claim can be worth a lot, depending on who is making it and in what context.

You are missing the point. The OP is claiming this vulnerability isn't as easy to exploit, and all the examples rely on a chain of unrelated vulnerabilities to show the PHP vulnerability working.

You asserted without evidence that there is working examples.

Someone asked for those examples, and instead of providing them, you insulted everyone.

I'm not going to offer you evidence.

Don't engage the troll. Look at their comment history, they comment senseless comments like this everywhere.

Then show me how it would work on modern Linux servers that has ASLR on by default short of spamming it DoS style.

If you claim only ancient LAMP boxes are vulnerable, then that's like me saying your "your 80 year old grandma is more prone to accidents".

Also just to reply to RagingCactus's sibling comment which was somehow downvoted to death (HN users, never change.) for quoting the Wiz post, the two PHP vulnerabilities alone are still not to bypass ASLR.

CVE-2026-109619 is the main memory related vulnerability but it alone isn't enough to break OS level ASLR unless you spam it (brute forcing).

Reply on news.ycombinator.com