Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a WordPress RCEs with GPT5.6 and $25

slcyber.io

Post reply on HN
Print view View original

201–210 of 247 posts

Re: I found a WordPress RCEs with GPT5.6 and $25

#201

Post by mschuster91 »

grugq wrote: post #190
bink wrote: post #121

Earlier quoted context omitted.

I work in the field and I just cannot believe anyone would pay that much for a Word Press exploit. People pay money for iOS or Android because there is valuable information stored on devices running those operating systems. There's absolutely nothing of value on any Word Press site. The only possible reason I can think of is for a watering hole attack, but that would require a second exploit that would be worth far m…

Bulk reply to all the people replying. bink is correct. The people who buy exploits are governments. There is very little interest in Wordpress or indeed any target that isn't a browser or a mobile. Browsers and mobiles are the only things that are perennially useful to an intelligence agency. Those two are reliable access vectors for the vast majority of things that interest government organisations.

> There is very little interest in Wordpress

I'd disagree here. Still 41% of all sites use Wordpress [1]... and that means a lot of targets, and a lot of ways to target them. Your good ole' deface/ransomware extortion scheme, leaking data supposed to be confidential (such as account lists), trusted spreaders for exploits, or the latest hit, bets on "prediction markets" that have some Wordpress site set as oracle. People are willing to screw around with airport weather stations to manipulate bets [2], it's not that much of a stretch to assume such incentives would also apply for website hackers.

[1] https://www.wpzoom.com/blog/wordpress-statistics/

[2] https://edition.cnn.com/2026/04/23/europe/france-weather-sen...

Re: I found a WordPress RCEs with GPT5.6 and $25

#202

Post by mschuster91 »

thejosh wrote: post #40
asimovDev wrote: post #33

Earlier quoted context omitted.

As a junior I am glad I happened to start working with PHP on version 7. I had some peeks at our legacy PHP5 stuff (all killed now thankfully) and it looked very different. I am sure it would suck to work with.

php7 was such a great time period for PHP, honestly lots of great experimental projects around that time too (HHVM before that, etc).

PHP 8 is good too. Lots of syntactic sugar to make your life so, so much easier.

Re: I found a WordPress RCEs with GPT5.6 and $25

#203

Post by 9dev »

cute_boi wrote: post #155
9dev wrote: post #71

Earlier quoted context omitted.

Let me convince you! :-) There are match expressions and arrow functions: $slug = $title |> trim(...) |> (fn($str) => str_replace(' ', '-', $str)) |> (fn($str) => str_replace('.', '', $str)) |> strtolower(...); There is meta-programming with annotations: final class PostsController { #[AccessControl(fn(Request $request, Post $post) => $request->user === $post->getAuthor() )] public function update(Request $request, P…

Looks like PHP is trying to act like Elixir. And all these are very new thing which we can't implement in wordpress because you have to care about backward compatibility.

These "very new things" have, in part, been available for more than 6 years now. Not to speak of all the other PHP features WordPress chose to forgo, like PDO with prepared statements (which completely eliminates SQL injections), which came out 21 freakin' years ago.

There are many very successful and professional PHP projects with millions of users that seem to be able to migrate to newer PHP versions just fine.

Whatever the WordPress developers are claiming are the reasons for their irresponsible codebase and their inability to improve it is nobody's fault but their own.

Re: I found a WordPress RCEs with GPT5.6 and $25

#204

Post by tredre3 »

jaredklewis wrote: post #162
marysol5 wrote: post #145

Earlier quoted context omitted.

Wordpress is a great web shell, shame it also comes with a blog

Is it? I did a project with WP a very long time ago and was kind of baffled. Like it's nice to have an good rich text editor, I got that part. But the absolute monstrosities people developed to extend WP, when they could have just used MySQL and PHP directly, astounded me. Like I couldn't figure out what WP was offering? It was just like a blog that you could painfully hack into something else if you wanted to. But e…

I suspect you missed the joke: A web shell is a script to execute arbitrary commands, i.e. Remote Code Execution.

Re: I found a WordPress RCEs with GPT5.6 and $25

#205

Post by 9dev »

cute_boi wrote: post #154
9dev wrote: post #18

Earlier quoted context omitted.

The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.

I don't think PHP is a beautiful language. If it was Laravel wouldn't need to rewrite every function from standard library. And, I see no reason to use it compared to Typescript.

I never really understood these complaints about the standard library, that's not what makes a language really. Yes, it's ugly, yes, it carries 30 years of baggage, but it's PHP the language that allows you to interact with a much more convenient abstraction layer provided by Laravel.

PHP can run the same code fully dynamically typed or with very strict type annotations, depending on your requirements. It has runtime reflection APIs that are so cheap that you don't really have to think about using them. You can do OOP or FP with PHP, or even procedural HTML-interleaved-with-PHP if that's your thing. It has late static binding, so you can defer to child classes from their parent class. There are generators and fibres as first-class language constructs now. Property hooks are an extremely clear pattern, way better than in many other languages.

Generally, there have been tons of new syntax extensions over the years, and they all slot in gracefully. With PHP 8.6, we're going to get partial application for functions, which will make PHP 8.5's match expressions one of the most ergonomic implementations I have seen yet!

Re: I found a WordPress RCEs with GPT5.6 and $25

#206

Post by tredre3 »

9dev wrote: post #131
timbits98 wrote: post #105

Earlier quoted context omitted.

...but do they truly pretend SQL injections aren't really a problem, or do they in fact promote practices and provide pathways to reduce that risk?

What they do is put lipstick on a pig! There is no need to "reduce" the risk of SQL injections when you can use a safe API that eliminates the entire error class. This is a solved problem for the rest of the world!

PHP offers that safe API, though, and always has (prepared statements). The same one as all other languages.

PHP might seem worse than other languages due to a combination of factors:

- It's the most used one by far, even though few of us like to admit it.

- Old tutorials still come up during web searches, so "SELECT * FROM `table` WHERE id = $id" will still be written today.

Re: I found a WordPress RCEs with GPT5.6 and $25

#207

Post by tredre3 »

sofixa wrote: post #156
cute_boi wrote: post #154

Earlier quoted context omitted.

I don't think PHP is a beautiful language. If it was Laravel wouldn't need to rewrite every function from standard library. And, I see no reason to use it compared to Typescript.

Ecosystem? The JS/TS ecosystem approach is to use as many libraries as possible for the sake of it, exposing you to a massive supply chain risk. PHP doesn't suffer from that because there are barely any libraries for it.

> PHP doesn't suffer from that because there are barely any libraries for it.

You don't need many libraries in a typical project, because PHP is batteries-included and if you use a framework it does all the rest for you, that is true. But there are still hundreds of thousands of packages with billions of installs:

https://packagist.org/statistics

Re: I found a WordPress RCEs with GPT5.6 and $25

#208

Post by SoftTalker »

trollbridge wrote: post #195
grugq wrote: post #183

Earlier quoted context omitted.

this is the most accurate summary.

I actually found a 1999 iMac set out for a special rubbish pick up day. The owner of the house was there so I chatted a bit, asked her if she minded if I took it. It had last been booted on it, complete with working hard drive an; MacOS X 10.3. So $1.299 -> $0.

That's just typical for computer hardware though. Depreciation is 3-5 years normally, after which it's considered worthless.

Re: I found a WordPress RCEs with GPT5.6 and $25

#209

Post by apercu »

bink wrote: post #121
kuroguro wrote: post #99

Earlier quoted context omitted.

Likely referencing https://www.crowdfense.com/exploit-acquisition-program/ Zerodium used to offer up to 300k in 2021 https://www.securityweek.com/sites/default/files/images/Zero... These brokers usually don't pay the bulk sum - they sell access to nation actors and you get payed out over time as long as the bug is not patched to discourage reselling and burning it. I doubt anyone would confirm if they got the full pa…

I work in the field and I just cannot believe anyone would pay that much for a Word Press exploit. People pay money for iOS or Android because there is valuable information stored on devices running those operating systems. There's absolutely nothing of value on any Word Press site. The only possible reason I can think of is for a watering hole attack, but that would require a second exploit that would be worth far m…

>There's absolutely nothing of value on any Word Press site.

I would hope not, but I’d be surprised if that were true across the millions(?) of Wordpress sites?

Re: I found a WordPress RCEs with GPT5.6 and $25

#210

Post by antonymoose »

CM30 wrote: post #59
9dev wrote: post #18

Earlier quoted context omitted.

The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.

It's just because they don't want to break anything in existing sites, sorta like how Microsoft doesn't generally want to break programs on Windows. So, changes are fairly incremental, and the quality is about what you'd expect from a piece of software that's decades old with no plan for what happens if it got this far. But what do you do in that situation? If they change the structure too much, then either they make…

If the existing at-risk functionality is a security issue I feel like that’s a good time to throw the proverbial flag on the play and make it an issue. Letting consumers play host to malware and phishing portals is the worse move.
Post reply on HN