yes, they sat on a working exploit for 2 months to hone their magic "this exploits everything"-script. In other words: criminals.

▲

NitpickLawyer 3 hours ago | parent | next [-]

No idea what your comment is even about. The researchers that found and reported this did not sit on this for 2 months.

> 1 August 2026 [...] Ryan Austin finds the RCE paths, tweets a cryptographic hash on 5 August, and submits the bug and working RCE proof-of-concept to PHP between 11 August and 14 August.

> 19–24 August 2026: Wiz Research independently collides with the same bug family using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, reporting its variants on 24 August.

I get some skepticism about marketing copy, but your comment is blatantly wrong and needlessly rude.

▲

fock 3 hours ago | parent [-]

oh, so you say they only sat on it for a week? And then they exhaustively searched all exploit-paths so they have a demo ready 2 months later?

	▲	NitpickLawyer 2 hours ago \| parent [-]
		> so you say they only sat on it for a week? This is absurd, and it shows that you have absolutely 0 idea of how any of this works. Finding a bug and delivering a working RCE 11 days later is absolutely not "sitting on it". This is how this works. You need time to test, exploit, confirm, and so on. Sorry, but just stop being so negative. This can't be healthy for you.

▲

gruez 3 hours ago | parent | prev [-]

>In other words: criminals.

You're not required to disclose bugs, nor is developing exploits a criminal offense (assuming no intent/conspiracy to hack stuff).