| ▲ | scottgg 3 hours ago |
| Did they actually do anything good here ? Is this really marketing in the middle of this shitshow ? |
|
| ▲ | Ajedi32 3 hours ago | parent | next [-] |
| They found a vulnerability and reported it; isn't that a good thing? Are you suggesting it would be better to just not look for vulnerabilities, hoping that if nobody knows they exist, they can't be exploited? I thought that logic had been widely discredited in the security community long ago. |
| |
| ▲ | ctoth 4 minutes ago | parent | next [-] | | Copenhagen interpretation of security, doncha know? | |
| ▲ | 3 hours ago | parent | prev | next [-] | | [deleted] | |
| ▲ | ilogik 3 hours ago | parent | prev | next [-] | | Calif found the vulnerability, not OpenAI | | |
| ▲ | Ajedi32 2 hours ago | parent | next [-] | | > Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet initiative | | |
| ▲ | senordevnyc an hour ago | parent | next [-] | | These people are so blinded by hatred, I don't know why we even bother anymore. | | |
| ▲ | SolarNet 4 minutes ago | parent | next [-] | | If you read the calif report > No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase. This shows that "know your target" is still as applicable as ever, even in the LLM dominated VR age. No model is simply capable of unearthing "all bugs" with simple prompts. They used a public model as a research assistant and a code assistant. They guided it with expert deep knowledge of the project. OpenAI did not lead this, ChatGPT was not instrumental in this. It is perhaps at best to say OpenAI made it possible to find the bug more quickly. And on the double edged sword, also made it easier for it to be exploited days ahead of release. So I agree with the original commentator, did they on the balance actually do anything good here? | |
| ▲ | Banditoz an hour ago | parent | prev | next [-] | | I think it's a reasonable ask to know:
* What is the vulnerability?
* Am I affected? It's very difficult to answer those two questions, through all the marketing and fluff text. | |
| ▲ | ilogik an hour ago | parent | prev [-] | | Is this about my comment about Calif being the ones who found the vulnerability and not OpenAI? Am I wrong? |
| |
| ▲ | ilogik 2 hours ago | parent | prev [-] | | [dead] |
| |
| ▲ | nicce 3 hours ago | parent | prev [-] | | Wiz claims they they found it with Gemini? I have no idea who actually found it. Edit: Apparently both found independently |
| |
| ▲ | Noaidi 2 hours ago | parent | prev [-] | | If they can find the vulnerability anyone can. This whole "patch the planet" is marketing trying to cover up for the danger AI is unleashing on internet infrastructure. |
|
|
| ▲ | Maxious 3 hours ago | parent | prev | next [-] |
| > 1 August 2026: 2 days after OpenAI invites Calif to join its “Patch the Planet” initiative, Ryan Austin finds the RCE paths, tweets a cryptographic hash on 5 August, and submits the bug and working RCE proof-of-concept to PHP between 11 August and 14 August. https://deadneurons.substack.com/p/php2shell-explained-php2s... |
| |
|
| ▲ | fock 3 hours ago | parent | prev [-] |
| yes, they sat on a working exploit for 2 months to hone their magic "this exploits everything"-script. In other words: criminals. |
| |
| ▲ | NitpickLawyer 3 hours ago | parent | next [-] | | No idea what your comment is even about. The researchers that found and reported this did not sit on this for 2 months. > 1 August 2026 [...] Ryan Austin finds the RCE paths, tweets a cryptographic hash on 5 August, and submits the bug and working RCE proof-of-concept to PHP between 11 August and 14 August. > 19–24 August 2026: Wiz Research independently collides with the same bug family using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, reporting its variants on 24 August. I get some skepticism about marketing copy, but your comment is blatantly wrong and needlessly rude. | | |
| ▲ | fock 3 hours ago | parent [-] | | oh, so you say they only sat on it for a week? And then they exhaustively searched all exploit-paths so they have a demo ready 2 months later? | | |
| ▲ | NitpickLawyer 2 hours ago | parent [-] | | > so you say they only sat on it for a week? This is absurd, and it shows that you have absolutely 0 idea of how any of this works. Finding a bug and delivering a working RCE 11 days later is absolutely not "sitting on it". This is how this works. You need time to test, exploit, confirm, and so on. Sorry, but just stop being so negative. This can't be healthy for you. |
|
| |
| ▲ | gruez 3 hours ago | parent | prev [-] | | >In other words: criminals. You're not required to disclose bugs, nor is developing exploits a criminal offense (assuming no intent/conspiracy to hack stuff). |
|
