Used this as a base: https://jackalsyn.com/posts/php-up-2026.html

But created my own based on it since it feels sketchy running someone else's exploit poc ya know. Ran it first in a vm before running it against a production site.

They've retracted RCE capabilities from that site, said they made a mistake and it's a crash bug. So what base did you use?

I ran the PoC on my dev environment, the PoC is not complete and does not work.

If you maintain a 9 figures business, I would recommend to not rely on that and shut it down or at least do more.

How? This guy makes over $100k/mo from his PHP sites:

https://x.com/levelsio

Wait til you hear about The Facebook.

Facebook hasn't used PHP for a very long time. It's been using Hack for over 12 years, which was initially based off PHP but it's deviated quite significantly now. It's now nearly entirely statically-typed, and has a bunch of features that PHP doesn't have. IO is fully asynchronous using async/await syntax (like C# or JavaScript), functions can be marked as pure, and a bunch of other things useful in large codebases.

It still uses the same request model as PHP, since that's genuinely useful for web requests. It's easier to avoid memory leaks if each request is entirely self-contained and there's no global state persisted between requests (other than APC and opcode caches)

Wait until you hear that banks use Perl.

Do you remember the last time Perl had a flaw like this that took every bank down? I don't.

bugzilla still relies on perl's non-existing tainting of hash keys. I fixed that about 10 years ago, but perl5 never did.

then you need to use a correct csrf token. it doesn't protect against this, anyone can get a valid csrf token, every visitor gets one.

I tried it too in a clean Debian Trixie container and got no crash.

This link gets me a shitton of extremely intrusiv ads, some of which look like malware (auto-downloading an "OperaSetup.exe"). Is pastebin already compromised?

I got this same earlier, but now it seems to be working. Perhaps just an oddly timed bug with some ads that has nothing to do with the incident?

Pastebin is just sketchy for a while now

it now serves ads that instantly start those downloads its been like that for a couple of weeks

On which OS and Server did you run the exploit against?

Fintech makes 9 figures. I make 6 there and 6 at my stealth :-)

What is a "stealth"? A secret side project?

Basically taking two full-time jobs and lying about it

God I wish I had the energy to have 2 fulltime jobs. I barely have enough for 1

The problem with the hustle is that I'd have to hustle.

Mood.

It's my side business.

One of many languages. It has its role.