221–230 of 247 posts
Earlier quoted context omitted.
The great irony is they still sport their "Code is Poetry" mantra on their website [0]. If code is poetry, Wordpress is a new genre of it, probably? [0]: https://codex.wordpress.org/WordPress_Philosophy
If code is poetry, WordPress was written by William McGonagall https://en.wikipedia.org/wiki/William_McGonagall >.
Earlier quoted context omitted.
Of course it is. It just no longer exists.
Oh, you've done business with them then? Know someone who has?
Just because they're exclusive about their clients doesn't mean they're not real. Their impact and effectiveness is a separate topic though. I don't think they're still actively operating or taking new clients, at least.
btw: "Oh, so you've done x?" What a snarky and confrontational way to ask someone something. Especially when it's asserting a well documented company and person is "not real".
There is no evidence that $500k has been paid or would be paid for an exploit like this one. Given that the article says that prompts are modified like they are holy scripture, perhaps sell the prompt for $500k. The author works for https://www.assetnote.io/ , which has AI products for automated scanning.
There is no evidence that $500k has been paid or would be paid for an exploit like this one. Given that the article says that prompts are modified like they are holy scripture, perhaps sell the prompt for $500k. The author works for https://www.assetnote.io/ , which has AI products for automated scanning.
"People paid $5,000 for a Macintosh computer when they were new. I found one at a yard sale for $25."
Earlier quoted context omitted.
Oh, you've done business with them then? Know someone who has?
Yes, I have briefly done business with them as well. We also worked with Bekrar and Vupen briefly. Albeit, it was done through a broker. The second time around, we exited negotiations. Just because they're exclusive about their clients doesn't mean they're not real. Their impact and effectiveness is a separate topic though. I don't think they're still actively operating or taking new clients, at least. btw: "Oh, so y…
Earlier quoted context omitted.
To construct dynamic sql queries to have to string concatenate at least some parts, . User data should of course be passed via prepared statements.
One usually uses "query builder" pattern for that. Also, regarding placeholders, historically many DB and frameworks do not support passing lists for a value in a placeholder (like "WHERE id IN(?)") so users of such software fall back to string concatenation.
Earlier quoted context omitted.
Is it? I did a project with WP a very long time ago and was kind of baffled. Like it's nice to have an good rich text editor, I got that part. But the absolute monstrosities people developed to extend WP, when they could have just used MySQL and PHP directly, astounded me. Like I couldn't figure out what WP was offering? It was just like a blog that you could painfully hack into something else if you wanted to. But e…
I suspect you missed the joke: A web shell is a script to execute arbitrary commands, i.e. Remote Code Execution.
But yes, I agree, WP is very useful for those times when you need to run a quick `sudo rm -rf /` command but can't get to a terminal.
I feel like I've seen plenty of non-AI, pre-2020 SAST tools catch SQLis like the one mentioned here, and if nothing else, then a code review ought to catch it. Is WordPress not using code reviews and/or SAST?
They would not catch it, it requires combining multiple vulns.
Earlier quoted context omitted.
Yes, I have briefly done business with them as well. We also worked with Bekrar and Vupen briefly. Albeit, it was done through a broker. The second time around, we exited negotiations. Just because they're exclusive about their clients doesn't mean they're not real. Their impact and effectiveness is a separate topic though. I don't think they're still actively operating or taking new clients, at least. btw: "Oh, so y…
[flagged]