Took them almost 7 years even. According to the Calif write-up it was already reported in 2019 (https://bugs.php.net/bug.php?id=78876) and 2024 (https://ostif.org/php-audit-complete/).
replyLol wait so OpenAI's LLM to discover this vulnerability most likely just looked it up in an old forum post?
replyThis isn't a terribly uncommon method of 'discovery'. In maths and sciences there have been tons of papers that have highlighted something new but were never really connected to anything else and then largely forgotten. Later they are picked up by someone else and connected to a much bigger whole.
replyIt's only one piece in the full exploit chain.
replyThat's what my agent did to find a UAF. It just took a public one from calif off the internet and found it still flagged asan.
reply[flagged]
replyThat's how 90+% of script kiddy -type hackings happen, isn't it. That or publically available databases without a password.
replyAI is gonna make our stuff pretty robust, eventually. The transition phase might hurt a bit.
The bug you posted was patched and fixed 6 years ago, and none of the other bugs in the audit showcase that issue. Are you sure these are the right links?
replydeleted
replyNo way to prevent this, says only language where this regularly happens
replyCriticals happen in other languages all the time. You are seeing this with PHP in the news because it's used on 70% of the Internet.
replyhttps://fedi.katze.sh/@elise/117479383739450605
reply¯ \ _ ( ツ ) _ / ¯
LOL
replyPHP will always be the slop before AI.