Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a WordPress RCEs with GPT5.6 and $25

slcyber.io

Post reply on HN
Print view View original

111–120 of 247 posts

Re: I found a WordPress RCEs with GPT5.6 and $25

#111

Post by pwillia7 »

denysvitali wrote: post #55
ahartmetz wrote: post #4

The surprising (and possibly untrue) thing is the high price of canned vulnerabilities. WordPress is known as the remote root shell with a blogging feature.

I still don't understand why, for a blog, a static page isn't enough - especially since most of the WordPress issues are "solved" by adding caching. I do understand it from an user perspective (it's easier to tell the average user to drag and drop rather than committing to a GitHub repo and letting hugo build the website), but from a security standpoint WordPress is really just waiting for a vulnerability (either in…

WPE tried to make Faust.js a thing so you could use WP CMS but generate a modern static site but I don't think it really took off much

Re: I found a WordPress RCEs with GPT5.6 and $25

#112

Post by T3RMINATED »

Zsfe510asG wrote: post #88

There is no evidence that $500k has been paid or would be paid for an exploit like this one. Given that the article says that prompts are modified like they are holy scripture, perhaps sell the prompt for $500k. The author works for https://www.assetnote.io/ , which has AI products for automated scanning.

[dead]

Re: I found a WordPress RCEs with GPT5.6 and $25

#113

Post by StrauXX »

tptacek wrote: post #108
kuroguro wrote: post #99

Earlier quoted context omitted.

Likely referencing https://www.crowdfense.com/exploit-acquisition-program/ Zerodium used to offer up to 300k in 2021 https://www.securityweek.com/sites/default/files/images/Zero... These brokers usually don't pay the bulk sum - they sell access to nation actors and you get payed out over time as long as the bug is not patched to discourage reselling and burning it. I doubt anyone would confirm if they got the full pa…

[flagged]

Of course it is. It just no longer exists.

Re: I found a WordPress RCEs with GPT5.6 and $25

#115

Post by elmer2 »

cromka wrote: post #29

This assumes those who'd pay $500k don't have the skill to use GTP5.6 for the same purpose themselves?

Then why didn't we see the same writeup earlier? If you look through the writeup, you still need the skills to go through what the LLM gives you and actually create a valid proof of concept.

I've been using LLMs to find security vulnerabilities and there is no way I can just submit what I found and call it a day (many try).

Re: I found a WordPress RCEs with GPT5.6 and $25

#116

Post by Hizonner »

kuroguro wrote: post #99
Zsfe510asG wrote: post #88

There is no evidence that $500k has been paid or would be paid for an exploit like this one. Given that the article says that prompts are modified like they are holy scripture, perhaps sell the prompt for $500k. The author works for https://www.assetnote.io/ , which has AI products for automated scanning.

Likely referencing https://www.crowdfense.com/exploit-acquisition-program/ Zerodium used to offer up to 300k in 2021 https://www.securityweek.com/sites/default/files/images/Zero... These brokers usually don't pay the bulk sum - they sell access to nation actors and you get payed out over time as long as the bug is not patched to discourage reselling and burning it. I doubt anyone would confirm if they got the full pa…

Why would anybody trust criminals to pay them over time?

Re: I found a WordPress RCEs with GPT5.6 and $25

#120

Post by kamranjon »

perarneng wrote: post #114

How do you find exploits without risking someone seeing your attempt and reporting you as a hacker? do you register first somewhere?

You can run Wordpress locally in your own sandbox to test these vulnerabilities, you don’t have to break any laws.
Post reply on HN