David G. Johnson

man, the whole php2shell discourse is incredibly frustrating. 1. people claimed vendors were exaggerating the vulnerability and that it was practically hard to exploit. 2. they pointed to the unclaimed wallet in stealmybitcoin as "ground truth" supporting that argument. 3. except apparently nobody bothered to check how badly configured the challenge was in the first place. what annoys me is how confidently people, including security professionals, jumped on the bandwagon to declare the vulnerability overhyped based on a challenge that wasn't even properly working. like, think about whose narrative is actually more dangerous here. the vendor saying php2shell is reliably exploitable and urging people to patch, or someone pointing to a broken challenge as "ground truth" that the vulnerability is overhyped and practically hard to exploit? i agree it's hard to exploit without a frontier model or a highly skilled operator using capable open models. not everyone has access to either, and that could partly explain why we aren't seeing widespread exploitation. but does that really change how we should think about patching? you can reasonably assume well resourced threat actors have access to frontier models and talent to repro. they're not necessarily doing amateur spray and pray attacks, right? they probably have specific targets, and can afford to spend hours adapting an exploit to those environments. i don't think you're explicitly telling people not to patch. but using an unsolved, badly configured challenge as evidence that the vulnerability is overhyped can give people false confidence and lead them to delay patching.