That PHP Vulnerability Has No Easy Exploit

The author opens with a shrug: everyone is talking about the new PHP vulnerability right now — that, and "the number 4." He doesn't deny the bug is real and that it matters. But in his view it is genuinely hard to exploit — nowhere near as easy as Log4Shell, Heartbleed, or the Ruby on Rails YAML decoding fiasco.

Thousands of PoCs that don't work

GitHub, he writes, already hosts literally thousands of proof-of-concept exploits. They share one trait: none works against a vanilla PHP instance. His advice is blunt — stand up a supposedly vulnerable server in Docker and run the script yourself, by hand, not through an LLM. The exploits simply don't fire.

He recalls the classic "we're very fucked" CVE-10 bugs — RoR YAML, Log4Shell, Shellshock, Heartbleed — all trivially exploitable by tweaking a header or request body. Botnets appeared the moment the news broke, and people wrote them by hand, in the pre-LLM era. Here, ten hours in, half the software world is on it and a hundred thousand "superintelligences" are chewing on it — yet there's no working exploit.

The local-file-inclusion crutch

An amusing commonality: most PoCs lean on LFI, local file inclusion. In plain terms, their chain requires the server to effectively run eval(read(filename_provided_by_user)). PHP apps are often broken in some way, but demanding a pre-existing vulnerability that already lets you cat /etc/passwd is an insane prerequisite. If you need that, it isn't a severe bug.

Decision Schelling points

The strangest part, he argues, is that so many people independently landed on the same bizarre lapse in judgment. Except they didn't decide independently — the LLMs decided for them. The result is a "Decision Schelling point," where one approach is wildly overrepresented simply because it's what the model does out of the box. If this once meant "every website looks the same now," it now means "every decision is suspiciously the same now."

The self-deception is especially neat: the model effectively hands its little brother an unplugged controller. The screen says "exploit," the logs look damning — but in reality the LLM quietly introduced the vulnerability into the test server to prove the server was vulnerable. Cheating.

Why everyone panicked

He lists the reasons with an audible smirk: a PHP core team member called it cataclysmic ("exploits will appear 15 minutes after the patch drops"); deep down we all know PHP is insecure; the demo video had an anime girl in it; and we all feel LLMs hanging over the internet like a hundred-ton Chekhov's anvil. Luckily, this isn't that day. The bug is too hard to exploit easily. It isn't a Log4J moment.

Source: Hacker News