Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a WordPress RCEs with GPT5.6 and $25

slcyber.io

Post reply on HN
Print view View original

41–50 of 247 posts

Re: I found a WordPress RCEs with GPT5.6 and $25

#41

Post by cheschire »

cromka wrote: post #29

This assumes those who'd pay $500k don't have the skill to use GTP5.6 for the same purpose themselves?

You read articles regularly about how X authority is provided cloud LLM history and uses it as evidence to prosecute a defendant.

Yet you think professional criminals are too stupid to launder their activities through an unscrupulous yet legal intermediary?

Re: I found a WordPress RCEs with GPT5.6 and $25

#42

Post by khurs »

cromka wrote: post #29

This assumes those who'd pay $500k don't have the skill to use GTP5.6 for the same purpose themselves?

People who make the money are not necessarily the people who can write the best code.

Elon Musk didn't write code for a rocket, he hired people who could.

Re: I found a WordPress RCEs with GPT5.6 and $25

#43

Post by khalic »

9dev wrote: post #18
progbits wrote: post #13

https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa... String concatenation SQL injection in the year 2026.

The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.

I remember multiple projects giving up on rewriting it. Maybe a machine with endless patience could do it?

Re: I found a WordPress RCEs with GPT5.6 and $25

#44

Post by blauditore »

gorszon wrote: post #6
ahartmetz wrote: post #4

The surprising (and possibly untrue) thing is the high price of canned vulnerabilities. WordPress is known as the remote root shell with a blogging feature.

Propably untrue, the only way to know is to do threat intelligence, and inflitrate those telegram groups where these brokers operate, I doubt the writer of the article did that. Maybe he conflated any vulnerability with a 0-day one?

...or was just looking for a clickbait title.

Surely someone once offered a vulnerability for 500k somewhere, but that doesn't mean someone bought it.

Re: I found a WordPress RCEs with GPT5.6 and $25

#45

Post by hparadiz »

9dev wrote: post #18
progbits wrote: post #13

https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa... String concatenation SQL injection in the year 2026.

The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.

It was like that in the old days too. Seriously who makes a postmeta table and goes "yea let's just throw everything in here. Indexes? Meh."

I cringe everytime.

Re: I found a WordPress RCEs with GPT5.6 and $25

#46

Post by Levitz »

CodeCompost wrote: post #22

I like the idea of not crediting the person who posted the bug but to the LLM that found it. People who find exploits using LLMs should never get a reward or credit.

It baffles me how this can be said without concern for first order consequences.

Re: I found a WordPress RCEs with GPT5.6 and $25

#48

Post by bilekas »

9dev wrote: post #18
progbits wrote: post #13

https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa... String concatenation SQL injection in the year 2026.

The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.

I'm convinced it's by design so that the community that build little businesses around wordpress still stay in the eco system. A client needs new functionality? That's be a week of work because god help anyone who wants to look into themselves.

WordPress is actively degrading the security and quality of the web I general. Has been for many many years.

Re: I found a WordPress RCEs with GPT5.6 and $25

#49

Post by hparadiz »

khalic wrote: post #43
9dev wrote: post #18

Earlier quoted context omitted.

The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.

I remember multiple projects giving up on rewriting it. Maybe a machine with endless patience could do it?

I've done it multiple times but no one's gonna use my off the shelf blog when there's a bagilian WordPress plugins they wanna use. But with AI you kinda sorta should just build your own blog. Doctrine with slime framework. You can even throw a WordPress plugin at the LLM and ask it to implement the same thing.
Post reply on HN