Yeah I don’t really get this, the rumor “there is some exploitable vulnerability in php” can’t really be the problem, because that’s probably known to everyone already. The rumor only helps you exploit it if there’s some specific hint how the exploit works.
Chainguard had a vague inkling that there was something in PHP and literally typed “find bad vulnerabilities in PHP” to a frontier model and independently discovered these.
What happens when you type the same into any other language is an exercise for the reader.
Someone leaked CVE numbers, and then someone else leaked descriptions of the PHP properties related to vulnerability itself in a blog post meta tags. Which limited the search area quite lot. And then PHP maintainers had to make announcement. That is quite different.
So how do we not have 10 php situations every day? Obviously just having a rumor that php was vulnerable wasn’t the exceptional problem here, the problem was that the rumor was specific enough to find the bug because it included mitigation advice.
I guess that according to you, in today’s age, just the rumours of a passenger being able to do a 3G pull up in a 737 should be enough for people to do it. No?
Let me tell you this:
- I never said VR & ED was impossible. I never said that a passenger flying a 747 was impossible either.
- I said, a rumour of something so generic as “a bug exists somewhere”, does absolutely nothing for the ability to pull something off. Not before, and not now.
However, that is exactly what you wrote. Then, in your previous comment, you are changing what you said and now you’re fighting a straw man.
Goodbye dude, I’m not spending more cycles on this. Go find some bugs lol.
"A rumor" or a confirmation by the maintainers that the bug exists? Oh well, I guess you believe the that Fermat's statement of his Last Theorem had absolutely no effect on how quickly or slowly it got solved. After all, it was just a rumor. It probably had no effect at all on how many mathematicians chose to try to solve it or not.
> you are changing what you said and now you’re fighting a straw man.
Not really. I think the issue is just reading comprehension on your part. Go back and read my original comment again and see if you understand it better this time. You made a ridiculous argument, which I responded to, how is that a strawman?
> Go find some bugs lol
I still don't understand what your deal is? Why do you think I'd be interested in that? It seems like a pretty basic concept that a person can know of a thing being possible without being personally interested in doing it?
> You: Well then go do that and come back with a proof of [insert whatever conjecture]. I'll wait.
What you're saying is "I don't believe it's possible to do thing X unless you personally demonstrate it to me, despite the fact it's verifiably been done before by others".
I'm not claiming I personally will find any critical security vulnerabilities in "Nginx, Apache and IIS". But you seem to be claiming that nobody in the world ever will?
> “[…] even if nobody leaked anything, and the only thing publicly known was the existence of the bugs, people would anyway have been able to find them independently.”
I never said it’s impossible for LLMs to assist or drive VR and exploit development. It’s just utter nonsense that “knowing that a bug exists” does anything meaningful for finding it independently, unless that bug contains signal.
Which it only does if an embargo is broken, which was the case here.
You don't see any difference between the maintainers of PHP telling the whole world, "try to find a bug in PHP in 24h", and one random guy on the internet telling another random guy on the internet to try to find a bug in Nginx, Apache or IIS? Surely making all interested security researchers with time on their hands focus on one thing with a specific deadline has no effect on the probability of finding a bug in that thing?
> then it doesn’t make finding the bug more likely for any independent researcher
See, I think the issue is that you misread my original comment, because this is an entirely wrong interpretation of it. Obviously I'm not saying that for any one given researcher who's already chosen to focus on PHP, that changes anything.
I suppose all your whining about strawmen and mental gymnastics is just you being unwilling to accept that (a) you misread my comment and (b) your reasoning in your reply was entirely illogical.
You know you can just stop replying if you want right? No need to tell me about it.
Pretty good. I'm not ashamed to say that I argue because it's fun, and because I'm right (unlike you). I'm also not so desperate to have the last word that I'll post a comment entirely without substance (like you did, and probably will do again in reply to this).
Turns out that money never was a good proxy for the public good, or even the ‘good’ of paying users. The goal has never been maximizing UX, the goal always was squeezing profits.
End-users not voting with their feet is misrepresenting the issue, it’s a symptom of end-users being actively lied to during campaigns (I think the euphemism for that is “lobby groups”).
Why? Because politicians care about being re-elected and their approval rates, and finance has proved to be an unnaturally large factor in that equation.
> The PHP Foundation got the PHP project into the Patch the Planet program, as part of which security firm Calif began an audit of PHP on July 30th, 2026. On August 11th researcher Ryan A at Calif reported an unconditional remote code execution with the same root cause as the OOM problem we had found in 2024. OpenAI independently reported the same root cause on the same day
How does this work? Calif works with OAI on Patch the Planet program. Calif reports the finding to PHP. OAI ‘independently’ reports it too, on the same day. I suppose Calif did communicate with OAI about said findings, or is this not how Patch the Planet operates?
It seems extremely coincidental.
I can say with high confidence that Nginx, Apache and IIS have a critical security vulnerability hidden somewhere in their codebase right now.
Please provide the prompt that uncovers it. Apparently knowing about the existence of bugs is enough nowadays right?
I’ll wait.
reply