81–90 of 247 posts
That was an incredible writeup! Chapeau to the author - thanks for taking the time to do a writeup. When Anthropic claimed Mythos chained 4 or 5 bugs to achieve sandbox escape and found bugs in core software, it sounded like bs. But here we are 2 months later seeing what they meant. Cybersecurity was always a hard sell; security flaws were invisible - by contrast a fence with a hole is visible to everyone - anyone ca…
the people that can afford it, sure.
https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa... String concatenation SQL injection in the year 2026.
The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.
Earlier quoted context omitted.
What an awful fix. Does WordPress seriously still use basic string concatenation (edit: and sprintf) to build SQL queries?
To construct dynamic sql queries to have to string concatenate at least some parts, . User data should of course be passed via prepared statements.
The cost of business nowadays? At what point does it become apparent that in today's world software needs continuous pen testing and scanning? If you don't your attackers will.
points to a bigger problem perhaps; software design, construction and distribution is fundamentally flawed.
Earlier quoted context omitted.
The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.
It's just because they don't want to break anything in existing sites, sorta like how Microsoft doesn't generally want to break programs on Windows. So, changes are fairly incremental, and the quality is about what you'd expect from a piece of software that's decades old with no plan for what happens if it got this far. But what do you do in that situation? If they change the structure too much, then either they make…
On another note - who needs WordPress in the age of Astro and LLMs? I mean, it's not a taunt, but a serious question - do people keep WordPress because it used to be the easiest solution to set up years ago, or are there still clear use cases where one can argue it's the best solution?
Given that the article says that prompts are modified like they are holy scripture, perhaps sell the prompt for $500k.
The author works for https://www.assetnote.io/ , which has AI products for automated scanning.
Earlier quoted context omitted.
I remember multiple projects giving up on rewriting it. Maybe a machine with endless patience could do it?
I've done it multiple times but no one's gonna use my off the shelf blog when there's a bagilian WordPress plugins they wanna use. But with AI you kinda sorta should just build your own blog. Doctrine with slime framework. You can even throw a WordPress plugin at the LLM and ask it to implement the same thing.
The surprising (and possibly untrue) thing is the high price of canned vulnerabilities. WordPress is known as the remote root shell with a blogging feature.
WordPress is one of the most hardened targets of all time