upvote
There are multiple write-ups on how the vulnerability works. The Calif one is the most detailed. Also, no one used Claude. There's a whole world of information out there when you read the original sources instead of social media distortions.

https://calif.io/php2shell/

https://www.wiz.io/blog/php2shell-php-rce

reply
> Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities

https://openai.com/index/coordinated-disclosure-of-critical-...

> Using Gemini 4 Argon, the team at Wiz has shown why frontier AI is a game-changer for cyber defense. For over a decade, these critical vulnerabilities remained unaddressed because vulnerability discovery and exploitation were incredibly complex.

- Raluca Ada Popa, Head of Gemini Security, Google DeepMind

reply
See? No Claude. Never mind that other man behind the curtain
reply
Neither of those are Claude. Checkmate.
reply
deleted
reply
This is the official exploit video in the writeup - https://www.youtube.com/watch?v=pfWZrdzvooc
reply
deleted
reply
Haven't you heard? The popular thing to do nowadays is to accuse someone of using AI the second anything is produced whatsoever.
reply
Interestingly enough there are papers that suggest that AI feeding on itself will degrade output quality over time. What I've noticed from my peers is that everything produced now looks the same, and they're sick of it.
reply
Someone had to say it:

DSHR's Blog

I'm David Rosenthal, and this is a place to discuss the work I'm doing in Digital Preservation.

Tuesday, June 30, 2026

Coprophagia Is Bad For You

https://blog.dshr.org/2026/06/coprophagia-is-bad-for-you.htm...

reply
I do tend to disclose my use of AI, but at the same time I don't feel like I'm required to. I'm doing it to signal that my use of AI was productive, and of value to people beyond myself.
reply
but... Calif have said that AI did find this bug.
reply
Agreed. The only main post was somebody on jackly something .com who overdosed on the matrix and communication skills of a squirrel picking random tokens from a dozen trees.

I'm actually curious if a lot of shit got hacked because so far it doesn't seem so. Though it seems like it should have? We always see these catastrophic vulnerabilities showing up but when are the ones where it is actually just widespread publicly dumping databases everywhere and at a point where someone non technical even registers it.

reply
I'm sure there is more to it than generally "ask Claude". I asked Claude this as a joke and it downgraded all the way to Sonnet before it would answer, and I was previously approved for their dual use cyber program.

The latest POC video for the php2shell exploit features a dancing anime girl. How would you create a video like this?

reply