Earlier quoted context omitted.
So people coding with LLMs shouldn't get paid then, right?
That is in fact the end goal of CEOs pushing LLM use yes. Not possible right now, but if it were they would absolutely take that option.
[citation needed]
I found a WordPress RCEs with GPT5.6 and $25
31–40 of 247 posts
Re: I found a WordPress RCEs with GPT5.6 and $25
#32> Is GPT5.6 Sol Superhuman? This is not a simple y/n question. Computers have been superhuman at playing chess for decades now. Reading this article, I guess they are superhuman at understanding code now as well.
> Computers have been superhuman at playing chess for decades now.
And at doing arithmetic for even longer /i
Re: I found a WordPress RCEs with GPT5.6 and $25
#33https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa... String concatenation SQL injection in the year 2026.
The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.
As a junior I am glad I happened to start working with PHP on version 7. I had some peeks at our legacy PHP5 stuff (all killed now thankfully) and it looked very different. I am sure it would suck to work with.
Re: I found a WordPress RCEs with GPT5.6 and $25
#34Re: I found a WordPress RCEs with GPT5.6 and $25
#35https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa... String concatenation SQL injection in the year 2026.
What an awful fix. Does WordPress seriously still use basic string concatenation (edit: and sprintf) to build SQL queries?
WordPress source code is a mess. They should re-write it from scratch using modern technologies, or even a framework like Laravel.
Re: I found a WordPress RCEs with GPT5.6 and $25
#36Re: I found a WordPress RCEs with GPT5.6 and $25
#37Interesting write-up and I do think LLM assisted/powered exploit disclosure is a real concern (I've been able to get models to create container breakouts from Linux LPEs relatively quickly). One thing I'm surprised about is that GPT-5.6 didn't block that prompt due to guardrails. My experience is that GPT-5.5 and up does not like offensive security work (similar to Opus 4.7+/Fable). I didn't notice it but I'd assume…
This might help https://chatgpt.com/cyber ease the guardrails a bit.
Re: I found a WordPress RCEs with GPT5.6 and $25
#38I like the idea of not crediting the person who posted the bug but to the LLM that found it. People who find exploits using LLMs should never get a reward or credit.
I agree! We should go all the way though and credit the authors of the data the LLM was trained on. People who just run LLMs training scripts should never get a reward or credit.
I take credit given all my infosec-related reddit posts they used for training.
Re: I found a WordPress RCEs with GPT5.6 and $25
#39https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa... String concatenation SQL injection in the year 2026.
Oh it's even worse: https://developer.wordpress.org/plugins/creating-tables-with...
>Rather than executing an SQL query directly, we’ll use the dbDelta function
>Note that the dbDelta function is rather picky, however. For instance:
>You must put each field on its own line in your SQL statement.
>You must have two spaces between the words PRIMARY KEY and the definition of your primary key.
>You must use the key word KEY rather than its synonym INDEX and you must include at least one KEY.
>KEY must be followed by a SINGLE SPACE then the key name then a space then open parenthesis with the field name then a closed parenthesis.
>You must not use any apostrophes or backticks around field names.
>Field types must be all lowercase.
>SQL keywords, like CREATE TABLE and UPDATE, must be uppercase.
>You must specify the length of all fields that accept a length parameter. int(11), for example.
Re: I found a WordPress RCEs with GPT5.6 and $25
#40Earlier quoted context omitted.
The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.
As a junior I am glad I happened to start working with PHP on version 7. I had some peeks at our legacy PHP5 stuff (all killed now thankfully) and it looked very different. I am sure it would suck to work with.
php7 was such a great time period for PHP, honestly lots of great experimental projects around that time too (HHVM before that, etc).