> 3. Chainguard sees dancing anime video, doesn't recognize Calif, and thinks the exploit is in the wild
replyI'm not sure about this part. I saw https://jackalsyn.com/posts/php-up-2026.html going around a bit over 12 hours ago, before the chainguard images went out, and plenty of other chatter of exploitation happening in the wild.
Which seems to be someone bullshitting with AI and had nothing to do with the exploit in question.
replyThat same user wrote a followup tweet last night asserting that their POC wasn't ready to do an exploit in the wild
https://x.com/J4ck3LSyN/status/2112753673235501137
replyOr maybe the anime girl video was an edit someone else made on top of an otherwise normal Calif video.
replyStill not great though.
Unbelievably the anime girl video was the official version from Calif.
replyThe video got taken down by a copyright claim from Sony Music Entertainment. Unthinkable levels of unprofessionalism by Calif.
replyNot really sure if 3 is correct. Might have been Calif leaks the video -> it goes viral -> people make PoCs based on the video -> Chainguard releases the binary because there seem to be credible PoCs out there (that are not just the Shigure Ui video).
replydeleted
reply