We do need to eventually see the proof that this was so urgent. Because if it wasn't then this was effectively a massive DOS attack on society.

"9.2" is a big claim and a powerful justification for action, but with OpenAI involved my faith is very low that this isn't largely a publicity stunt. Especially given the age of the vulnerability.

This should be somewhat testable.

I'd set up a model with cyber capabilities, maybe GLM 5.3, not sure if it needs to be abliterated?

Disable web access and let it work on exploiting the pre-patch PHP version in a VM, given the info we had yesterday.

Can it do it? How long does it take, and writing the findings into a skill, how quickly can it be used on new targets?

I'd be interested in giving it a try, but unfortunately I'm very busy this week.

... meanwhile:

crickets

I think its absolutely getting tripped up by mass hysteria to go offline for a couple of hours without confirming the severity.

How are you supposed to confirm the severity of an unreleased CVE 9?