Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a WordPress RCEs with GPT5.6 and $25

slcyber.io

Post reply on HN
Print view View original

141–150 of 247 posts

Re: I found a WordPress RCEs with GPT5.6 and $25

#141

Post by jorams »

9dev wrote: post #71
TacticalCoder wrote: post #51

Earlier quoted context omitted.

[flagged]

Let me convince you! :-) There are match expressions and arrow functions: $slug = $title |> trim(...) |> (fn($str) => str_replace(' ', '-', $str)) |> (fn($str) => str_replace('.', '', $str)) |> strtolower(...); There is meta-programming with annotations: final class PostsController { #[AccessControl(fn(Request $request, Post $post) => $request->user === $post->getAuthor() )] public function update(Request $request, P…

> There is meta-programming with annotations:

There is, but your example is not valid. You can't use short function syntax in constant expressions, it has to be an explicit `static function`.

The reason for this, IIRC (I can't find the GitHub issue or PR atm) is that these functions aren't allowed to close over any variables, and with fn syntax doing so is implicit. Rather than erroring they've disallowed the use of arrow functions entirely.

Re: I found a WordPress RCEs with GPT5.6 and $25

#142

Post by chrismorgan »

bayindirh wrote: post #61
9dev wrote: post #18

Earlier quoted context omitted.

The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.

The great irony is they still sport their "Code is Poetry" mantra on their website [0]. If code is poetry, Wordpress is a new genre of it, probably? [0]: https://codex.wordpress.org/WordPress_Philosophy

If code is poetry, WordPress was written by William McGonagall https://en.wikipedia.org/wiki/William_McGonagall>.

Re: I found a WordPress RCEs with GPT5.6 and $25

#143

Post by applfanboysbgon »

nativeit wrote: post #137
idiotsecant wrote: post #129

Earlier quoted context omitted.

Because if they don't other people will hear they don't pay and won't sell them 0days

How long do you figure a criminal reputation typically needs/wants to last? I have always been skeptical of “black market credit ratings”. If you happen to build one up, it’s likely only in order to rip someone off at a higher price and cash in the value of it. It’s not like you’ll need that good rep for your retirement.

ShinyHunters has been "in business" since 2019 and it is their reputation that resulted in eg. Canvas paying their ransom this year. Without that reputation, it is unlikely a large-scale ransom would have been paid, because the reputation is what gives them credibility that paying the ransom will actually result in the promise being upheld.

Re: I found a WordPress RCEs with GPT5.6 and $25

#144

Post by marysol5 »

bink wrote: post #121
kuroguro wrote: post #99

Earlier quoted context omitted.

Likely referencing https://www.crowdfense.com/exploit-acquisition-program/ Zerodium used to offer up to 300k in 2021 https://www.securityweek.com/sites/default/files/images/Zero... These brokers usually don't pay the bulk sum - they sell access to nation actors and you get payed out over time as long as the bug is not patched to discourage reselling and burning it. I doubt anyone would confirm if they got the full pa…

I work in the field and I just cannot believe anyone would pay that much for a Word Press exploit. People pay money for iOS or Android because there is valuable information stored on devices running those operating systems. There's absolutely nothing of value on any Word Press site. The only possible reason I can think of is for a watering hole attack, but that would require a second exploit that would be worth far m…

Surprising amount of gov use WP as a CMS on their websites. So it's not that far off.

Re: I found a WordPress RCEs with GPT5.6 and $25

#145

Post by marysol5 »

tonyedgecombe wrote: post #101
CM30 wrote: post #59

Earlier quoted context omitted.

It's just because they don't want to break anything in existing sites, sorta like how Microsoft doesn't generally want to break programs on Windows. So, changes are fairly incremental, and the quality is about what you'd expect from a piece of software that's decades old with no plan for what happens if it got this far. But what do you do in that situation? If they change the structure too much, then either they make…

This isn’t some problem that has developed over time. It was shit from day one.

Wordpress is a great web shell, shame it also comes with a blog

Re: I found a WordPress RCEs with GPT5.6 and $25

#146

Post by marysol5 »

mono442 wrote: post #53
9dev wrote: post #18

Earlier quoted context omitted.

The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.

PHP is a proof that you don't need elegant or good technical solutions to be successful. You can literally pile up slop together and still be successful.

I think PHP came right at the time that every man and his dog was a "web developer" and writing absolute unknowledgable stuff. And PHP allowed for it.

ASP had a bit of a barrier to entry because it required all the MS. Whereas PHP was everywhere.

Re: I found a WordPress RCEs with GPT5.6 and $25

#147

Post by marysol5 »

IshKebab wrote: post #103
9dev wrote: post #71

Earlier quoted context omitted.

Let me convince you! :-) There are match expressions and arrow functions: $slug = $title |> trim(...) |> (fn($str) => str_replace(' ', '-', $str)) |> (fn($str) => str_replace('.', '', $str)) |> strtolower(...); There is meta-programming with annotations: final class PostsController { #[AccessControl(fn(Request $request, Post $post) => $request->user === $post->getAuthor() )] public function update(Request $request, P…

The issue isn't that they haven't added a load of modern features; it's that they never fixed the old janky broken features.

Reminds me that in the PHP5 days, there's a load of similar functions of which the parameters switch around...

Re: I found a WordPress RCEs with GPT5.6 and $25

#148

Post by stellamariesays »

Zsfe510asG wrote: post #88

There is no evidence that $500k has been paid or would be paid for an exploit like this one. Given that the article says that prompts are modified like they are holy scripture, perhaps sell the prompt for $500k. The author works for https://www.assetnote.io/ , which has AI products for automated scanning.

[flagged]

Re: I found a WordPress RCEs with GPT5.6 and $25

#149

Post by marysol5 »

muvlon wrote: post #107
denysvitali wrote: post #55

Earlier quoted context omitted.

I still don't understand why, for a blog, a static page isn't enough - especially since most of the WordPress issues are "solved" by adding caching. I do understand it from an user perspective (it's easier to tell the average user to drag and drop rather than committing to a GitHub repo and letting hugo build the website), but from a security standpoint WordPress is really just waiting for a vulnerability (either in…

In many deployments, Wordpress started out as just a blog that is easy to edit right from the web browser, but then grew into way more. Most commonly, people end up retrofitting all kinds of e-commerce features onto it, and that's how you really get into the whole plugin mess. At that point, for better or worse, the Wordpress instance is serving important business needs that are not addressed by a static page.

It went from a blog, to an entire CMS. Which is bonkers

Re: I found a WordPress RCEs with GPT5.6 and $25

#150

Post by SpikedCola »

progbits wrote: post #13

https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa... String concatenation SQL injection in the year 2026.

Ahhh very interesting! Thanks for pointing this out, I saw an attack against one of our sites this weekend using this exploit.

> data: {'requests': [{'method': 'POST', 'path': 'http://:'}, {'body': {'requests': [{'method': 'GET', 'path': 'http://:'}, {'method': 'GET', 'path': '/wp/v2/widgets?author_exclude=1%29+AND+1%3D0+UNION+ALL+SELECT+0%2C1%2C0x323...

Post reply on HN