3 stories
The test was a price tag on the claim that AI makes PHP exploitation trivial. Within hours strangers had topped the wallet up to $2,000 and the prize was still unclaimed.
One commenter had an LLM-generated proof of concept that crashed the site. A crash is not a shell.
The top HN threads: facts from the discussions, both sides, insider voices. Email, Telegram, or RSS.
He follows the four-weekly PHP release cycle and compiles from source, so he wanted to warn people like him to update. The disclosure schedule changed after his post.
A commenter's rule: if you got the vulnerability details without the embargo, someone upstream broke it, not you.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped on 21 October, a day ahead of plan, after the CVE IDs leaked. Both bugs score CVSS 9.2 and need no login, and a proof-of-concept video went up by mistake.
In the thread, an admin racing across several servers said a three-line nginx rule blocking multipart uploads had been quietly protecting a machine he could not shut down.
