Hacker News Reader

jooops1on Chained PHP2Shell exploit roots 25 servers, including US Government servers

Why would someone send their exploit chain to a random for a mediocre 'bug bounty'. The bounty was later claimed by people who just did It for fun after work for fun with a LLM of their choice quickly.

jooops1on GitLab Security Incident: Attempted Exploitation of CVE-2026-97229

The key difference is even If an Integer overflows in Rust It still doesn't violate memory safety in safe Rust and therefore doesn't lead to exploitation.

jooops1on Today's PHP security release, and how we're strengthening security

That's irrelevant identify a non-toy language which responds to a serious RCE with vibe security.

jooops1on Today's PHP security release, and how we're strengthening security

Yet their response is doing vibe security to this which will never work. From my personal side I don't care about PHP to invest my free time into making such a project. Unfortunately as EU citizen I'm forced to care about PHP's security, because the government thinks It's a good idea to use such It.

jooops1on Today's PHP security release, and how we're strengthening security

So instead of using a memory safe language or harden the C code they hope LLMs will find bugs in their code? Neither do they mention how their way to patch Exceptions into C makes It very difficult for Fuzzers to find those bugs? Good luck this statement should tell everyone to migrate away from that horrible language and runtime.

jooops1on Solar surpasses nuclear power globally for first time

If we run out of Saltwater then we have very different problems at our hand.

jooops1on 11 year old unsoundness bugs found in Rust borrow checker

That's not completely correct. If the Rust or C++ compiler has a bug in both cases either the compiler has to be fixed or the program can be adjusted to work around said compiler bug If possible. However, It's fair to argue that the Rust compiler makes more assertions and is more complex, which results in a larger error surface.

jooops1on OpenAI agent hacked Australian government website, PM says

I hope this includes politicians in power as well, who acted like software security is an after thought.

jooops1on Quasar 438B: Europe's Leading AI Model

I do care, because those models can contain backdoors and 'open weight' models can require specialized hardware to run in the future.

jooops1on Malicious Rust crate Arrayref runs a build-time payload

Can you explain how an effect based language helps here? Also to note filesystem access can allow network access on many systems and also the other way around.

jooops1on Malicious Rust crate Arrayref runs a build-time payload

The author proposes to reinvent the wheel and depend on stale dependencies, which are EOL. Neither of that is an acceptable solution with LLM-based Agents being able to produce exploit(ExploitGym) chains in minutes from known bugs. The other issue is that Rust's forces the user to provide more information and APIs are usually kept generic for systems programmer, so standardizing things is not as straight-forward compared to Go where you can assume a memory-management, a virtual thread runtime and mostly ignore dynamic dispatching.

jooops1on Mistral Patent for “Code implemented tool calls”

Can there be consequences for those who grant those patents? It seems the primary examiner Brian W Wathen also granted prior Art patents to Salesforce and NCR Voyix as well.

jooops1on Assembly Hall of Shame

It increments rip by one.

jooops1on How memory safety CVEs differ between Rust and C/C++

Yep I agree C++ lacks many features Rust has solid support for. But the real issue with C++ is the development process, almost all the people involved in the Module system are rather old and worked for Microsoft once. They are just in their own bubble and not having an open RFC-process blocks experts in that field.