Hacker News Reader

Comment by tptacek | Hacker News Reader

See, this is the problem with this post. At this point, and in the absence of a public exploit people can play with, it's more fun to do the truther debate about the vulnerability than to assess the situation soberly, and the First Law of Message Boards thus dictates the discussion will be dominated by truther debates.

View on HN

You are missing the point. The OP is claiming this vulnerability isn't as easy to exploit, and all the examples rely on a chain of unrelated vulnerabilities to show the PHP vulnerability working.

You asserted without evidence that there is working examples.

Someone asked for those examples, and instead of providing them, you insulted everyone.

I'm not going to offer you evidence.

Don't engage the troll. Look at their comment history, they comment senseless comments like this everywhere.

> in the absence of a public exploit people can play with, it's more fun to do the truther debate about the vulnerability

I don't think anybody is asking for the code, but it would be nice to see the claims of working exploits that you're referring to.

A claim can be worth a lot, depending on who is making it and in what context.

Then show me how it would work on modern Linux servers that has ASLR on by default short of spamming it DoS style.

If you claim only ancient LAMP boxes are vulnerable, then that's like me saying your "your 80 year old grandma is more prone to accidents".

Also just to reply to RagingCactus's sibling comment which was somehow downvoted to death (HN users, never change.) for quoting the Wiz post, the two PHP vulnerabilities alone are still not to bypass ASLR.

CVE-2026-109619 is the main memory related vulnerability but it alone isn't enough to break OS level ASLR unless you spam it (brute forcing).

Reply on news.ycombinator.com