I found a WordPress RCEs with GPT5.6 and $25

Post by foco_tubi » Mon, Jul 20, 2026, 6:03 PM UTC

bink wrote: post #121

kuroguro wrote: post #99

Earlier quoted context omitted.

Likely referencing https://www.crowdfense.com/exploit-acquisition-program/ Zerodium used to offer up to 300k in 2021 https://www.securityweek.com/sites/default/files/images/Zero... These brokers usually don't pay the bulk sum - they sell access to nation actors and you get payed out over time as long as the bug is not patched to discourage reselling and burning it. I doubt anyone would confirm if they got the full pa…

I work in the field and I just cannot believe anyone would pay that much for a Word Press exploit. People pay money for iOS or Android because there is valuable information stored on devices running those operating systems. There's absolutely nothing of value on any Word Press site. The only possible reason I can think of is for a watering hole attack, but that would require a second exploit that would be worth far m…

Post by 9dev » Mon, Jul 20, 2026, 6:04 PM UTC

jorams wrote: post #141

9dev wrote: post #71

Earlier quoted context omitted.

Let me convince you! :-) There are match expressions and arrow functions: $slug = $title |> trim(...) |> (fn($str) => str_replace(' ', '-', $str)) |> (fn($str) => str_replace('.', '', $str)) |> strtolower(...); There is meta-programming with annotations: final class PostsController { #[AccessControl(fn(Request $request, Post $post) => $request->user === $post->getAuthor() )] public function update(Request $request, P…

> There is meta-programming with annotations: There is, but your example is not valid. You can't use short function syntax in constant expressions, it has to be an explicit `static function`. The reason for this, IIRC (I can't find the GitHub issue or PR atm) is that these functions aren't allowed to close over any variables, and with fn syntax doing so is implicit. Rather than erroring they've disallowed the use of…

Post by trollbridge » Mon, Jul 20, 2026, 6:16 PM UTC

grugq wrote: post #183

trollbridge wrote: post #158

Earlier quoted context omitted.

"People paid $5,000 for a Macintosh computer when they were new. I found one at a yard sale for $25."

this is the most accurate summary.

Post by j45 » Mon, Jul 20, 2026, 6:35 PM UTC

Post by nickff » Mon, Jul 20, 2026, 6:44 PM UTC

monster_truck wrote: post #175

Zsfe510asG wrote: post #88

There is no evidence that $500k has been paid or would be paid for an exploit like this one. Given that the article says that prompts are modified like they are holy scripture, perhaps sell the prompt for $500k. The author works for https://www.assetnote.io/ , which has AI products for automated scanning.

What do you think the venn diagram looks like for people willing and able to find things like that prior to LLMs and also sell them to a broker, and are also stupid enough to flaunt a massive flashing "arrest me!!!" sign Closest you're going to get is something like those kids in florida who just got wrapped for putting malware into steam games and draining peoples accounts. They were going to get caught anyways but…