Live data from Hacker News

I found a WordPress RCEs with GPT5.6 and $25

slcyber.io

71–80 of 247 posts

Re: I found a WordPress RCEs with GPT5.6 and $25

#71
post #18

Earlier quoted context omitted.

The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.

[flagged]

Let me convince you! :-)

There are match expressions and arrow functions:

  $slug = $title
      |> trim(...)
      |> (fn($str) => str_replace(' ', '-', $str))
      |> (fn($str) => str_replace('.', '', $str))
      |> strtolower(...);
There is meta-programming with annotations:

  final class PostsController
  {
      #[AccessControl(fn(Request $request, Post $post)
          => $request->user === $post->getAuthor()
      )]
      public function update(Request $request, Post $post): Response {
          // ...
      }
  }
Native (and optionally value-backed) enums:

  enum Status
  {
      case Draft;
      case Published;
      case Archived;
  }
Proper class property hooks, fully replacing getters and setters:

  class Data
  {
      public string $fullName {
          get => "{$this->firstName} {$this->lastName}";
          set(string $value) {
              [$first, $last] = explode(' ', $value);
              $this->firstName = $first;
              $this->lastName = $last;
          }
      }
  }
And tons of other features—among them asymmetric property visibility, fibres/green threads, DNF types, lazy object instantiation, an ever-improving yet fully opt-in static type system with runtime validation, a JIT compiler, an amazing package ecosystem and -manager, annotation-backed deprecation, and more.

Re: I found a WordPress RCEs with GPT5.6 and $25

#72
post #35

Earlier quoted context omitted.

What an awful fix. Does WordPress seriously still use basic string concatenation (edit: and sprintf) to build SQL queries?

WordPress source code is a mess. They should re-write it from scratch using modern technologies, or even a framework like Laravel.

A few months back, Cloudflare used AI to make a Rust rewrite of WordPress, but I doubt that they would have found or corrected issues like this on the way? https://blog.cloudflare.com/emdash-wordpress/

Re: I found a WordPress RCEs with GPT5.6 and $25

#73
post #31

Earlier quoted context omitted.

That is in fact the end goal of CEOs pushing LLM use yes. Not possible right now, but if it were they would absolutely take that option.

[citation needed]

Does "companies will cut unnecessary costs" need a citation?

Re: I found a WordPress RCEs with GPT5.6 and $25

#74
post #53
post #18

Earlier quoted context omitted.

The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.

PHP is a proof that you don't need elegant or good technical solutions to be successful. You can literally pile up slop together and still be successful.

Yeah; the common idea of dignity and self-respect is to replace the duct tape with proper engineering once you're successful though, instead of just taping ever more of it on top and pretending SQL injections aren't really a problem.

Re: I found a WordPress RCEs with GPT5.6 and $25

#75
That was an incredible writeup! Chapeau to the author - thanks for taking the time to do a writeup.

When Anthropic claimed Mythos chained 4 or 5 bugs to achieve sandbox escape and found bugs in core software, it sounded like bs. But here we are 2 months later seeing what they meant.

Cybersecurity was always a hard sell; security flaws were invisible - by contrast a fence with a hole is visible to everyone - anyone can ignore the locked gate and walk through the fence hole. With cybersecurity a hole in the fence may go unnoticed for years, maybe forever.

LLMs level the field. We will all benefit from more secure systems, a few people will get a lot of egg on their faces, and it will end the malpractice of underinvesting in software security to get a product out the door.

Re: I found a WordPress RCEs with GPT5.6 and $25

#76
post #59
post #18

Earlier quoted context omitted.

The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.

It's just because they don't want to break anything in existing sites, sorta like how Microsoft doesn't generally want to break programs on Windows. So, changes are fairly incremental, and the quality is about what you'd expect from a piece of software that's decades old with no plan for what happens if it got this far. But what do you do in that situation? If they change the structure too much, then either they make…

Even just introducing emulation layers for the old parts and making the new parts opt-in would be better than just giving up and keep on going. Plugin authors can choose the new subsystem as they publish updates or new plugins and themes, and in return they get speed and security guarantees.

And since the WordPress foundation controls the extension marketplace, they can reliably determine which parts of the API surface are in use, or even invest a chunk of money every month to send AI-written patches to plugin maintainers to ease the transition.

There would be so many ways to improve the situation (to the benefit of WordPress maintainers, customers, and ecosystem vendors alike, mind you!), but alas, they are stuck to their ways and will not.

Re: I found a WordPress RCEs with GPT5.6 and $25

#77
post #68

On another note - who needs WordPress in the age of Astro and LLMs? I mean, it's not a taunt, but a serious question - do people keep WordPress because it used to be the easiest solution to set up years ago, or are there still clear use cases where one can argue it's the best solution?

does Astro do WYSWIYG?

Re: I found a WordPress RCEs with GPT5.6 and $25

#78
post #35

Earlier quoted context omitted.

What an awful fix. Does WordPress seriously still use basic string concatenation (edit: and sprintf) to build SQL queries?

WordPress source code is a mess. They should re-write it from scratch using modern technologies, or even a framework like Laravel.

Mullenweg will never allow WP to slip away from his control. "He wrote it" so you can't have it.

Re: I found a WordPress RCEs with GPT5.6 and $25

#79

The surprising (and possibly untrue) thing is the high price of canned vulnerabilities. WordPress is known as the remote root shell with a blogging feature.

I still don't understand why, for a blog, a static page isn't enough - especially since most of the WordPress issues are "solved" by adding caching. I do understand it from an user perspective (it's easier to tell the average user to drag and drop rather than committing to a GitHub repo and letting hugo build the website), but from a security standpoint WordPress is really just waiting for a vulnerability (either in…

The non-profit I help with moved to Wordpress so people can edit the site without having to use git. (We have a lot more editors now)..
Post reply on HN