This will go unclaimed for a bit. It may still get claimed within the day, but

People do have the exploit. The risked opportunity cost of this being a honeypot (and handing over a functional exploit) vs just… not participating and hacking higher value targets (offensive actors) or not circulating any additional details (defensive actors who have privileged intelligence about the vulns) I just…

The value proposition here is so hilariously low for what is required to demonstrate stealing the bitcoin at all.

That doesn’t mean that people won’t try, and perhaps even succeed! But to what end? Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?

I, and many of my friends and cooks could take this easily. The difference is we know not to.

Make it $15-25k and it’ll get yoinked instantly, most likely without using PHP2Shell at all.

>and handing over a functional exploit

There are dozens (or hundreds) of functional exploits already. The problem with php2shell exploits is that (as of now) there's no "one exploit pwns all", and researchers need to spend nontrivial amount of time on every (potentially) exploitable target.

So I don't think I agree - it's a fun challenge for the itsec people around here, and some people will definitely try. There's no real opportunity cost here. The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.

80h ago everyone was advising everyone else to take all their websites immediately down.

Now it's only worth it to hack a website that's asking to be hacked if the prize is $15k.

If the actual price tag behind the “AI can trivially automate exploits, be afraid” narrative is more like $15,000 and not like $150, that puts the narrative in a very different light.

Can you spell out the economics for us?

Let's assume I am a white-hat hacker with access to this allegedly widespread exploit. Obviously, I understand why a nation-state attacker wouldn't want to share their exploit here but what do I as a random citizen stand to lose? It's not like I care about hoarding the exploit to pwn innocent civilians.

You seem to imply there's some economic reason such a white-hat hacker wouldn't take the $500 but don't actually say what it is.

Every reason you just gave for not hacking this server is also true for servers which don’t have a $500 prize, which is almost all of them out there.

I suspect this is going to be more a point about the fact that most PHP server configurations do not have the ability to be exploited by the recent vulnerability that made people think the AI vulnpocalypse was here

> I, and many of my friends and cooks could take this easily.

Sure you can.

> a fundamental misunderstanding of the economics at play

I’d say you’re the one who doesn’t understand the economics at play here. To me and I’m guessing the OP it’s quite simple. Have the exploits become common/simple enough to be worth $500 yet?

What an insufferable comment. For all the hullabaloo discussing the economic value of time about $500 being an insufficient prize, you still spent what I can only assume is several minutes penning a comment that derives you zero economic value whatever.

> I, and many of my friends and cooks could take this easily.

No, you couldn't.

> But to what end?

It is just kind of fun to poke at something like this.

> Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?

I don't give a shit about the $500, nor would I ever attempt actually hacking something that wasn't explicitly a game (like this).

> The difference is we know not to.

Borrrrinnnggggg

> handing over a functional exploit

I thought the exploit was trivial and we all need to be extremely worried and take down our php services until a patch? So what exactly are you handing over?

> I, and many of my friends and cooks could take this easily.

Extreme doubt.

It's worth it to someone.