undefined

points

[-]

That's always the case for a novel exploit. There isn't a lot of value in popping somebody's PHP blog, so people who've invested time and money into a zero-day exploit have little incentive to use it for that purpose.

The white hats want to extend the time before an exploit is in the hands of the masses who might do so just for the fun of it, and the black hats want to use it on high-value targets.

by ufmace11 hours ago|

parent|

[-]

I think the point is that this is completely the opposite of the narrative that was pushed about this bug - that there would be thousands+ of AI agents actively compromising every vulnerable site automatically regardless of value within minutes of the fix being released into the wild. Well, now it's 3 days after, and this has been up for 3.5 hours, and nobody has taken it yet.

by testaccount2812 hours ago|

prev|

[-]

random sites generally don't log carefully, or watch their logs if they do. so the risk to hacking them is low. this site almost certainly logs very aggressively. so the risk to hacking it is high.

based on differential risk, attackers will choose targets differently. they might reason that the risk/reward on this obvious trap is not worth it. but on joe shmo's php emporium, the reward is less, but so is the risk, and it might pencil out.

by malfist7 hours ago|

parent|

[-]

So your answer is people could hack this easily but logs scare them?

Well that's good news because my webserver also has logging

by QuantumNomad_3 hours ago|

parent|

[-]

> that's good news because my webserver also has logging

In the future, every website will carry a little blurb of text in the footer of their pages intended to scare off would-be hackers and their AI agents:

“The server of this website employs append-only remote logging and state-of-the-art monitoring and intrusion detection. Unauthorized access or attempts there of WILL be prosecuted to the fullest extent of the law. The outcome of such prosecution is and always will be astronomical amounts of money in damages that the guilty party will pay to the victim, alongside decades of prison time for the party guilty of computer crimes. Do not even try.”

by stavros1 hours ago|

parent|

[-]

Or rather "the software on this server is fully patched and everything is logged. If you hack it, we will sell the 0-day you used before you can".

by Paradigma111 hours ago|

parent|

prev|

[-]

"First person to get the wallet wins. If you don’t need the money, consider donating it to those who do: givewell.org."

What risk?