This looks like a trap. We have a working RCE that would claim this, but I don't want to demonstrate that because it might leak what we built to others. We still have a window for people to patch and I don't want to risk that.

https://x.com/dguido/status/2113825891021144306?s=46

Seems like everyone here has an exploit but they're all busy washing their hair, or thinking of the children, or making huge amounts selling their exploit on the darknet instead.

Given there are public patches and explanations of the issue, isn't it a little late to try to keep this under wraps?

Over a day or two we'll see whether people have an exploit - if more than a few people do, someone will claim this $1k soon. Out of curiosity, what do you plan to do with your exploit that you're holding back?

Whether it is a trap or not doesn't change the OP's point... they are trying to push back on the idea that all servers that have this vulnerability are going to be instantly hacked by bot swarms. If AIs are at the point now where they can all instantly create an exploit from a known vulnerability, then you would have no need to keep your exploit secret because everyone would already have one.

The fact that you keeping your exploit secret means anything already proves their point.

Wrong move. Exploiting this box proves it's exploitable. Not exploiting the box makes the entire computer security profession look like a bunch of worry worts and that the consulting fees are better off not paid. At worst, the owner of the box gets... what? Working exploit code that they'll have to reverse engineer anyway?

The implication of your comment is that the exploit is not trivial and magically available to anyone with some tokens to bash together, which refutes the position that there is an horde of AI agents and people compromising sites en-masse.

Lots of people said the embargo should be broken early because "the exploit is already in the wild". That does not normally mean an infosec researcher has a PoC on their private laptop, that means it has leaked, one way or another.

Had it, though? If it was in the wild at day -1, surely some script kiddie will be happy to run that exploit at day +4, because if they didn't someone else would.

There were many people saying things with great confidence and this is one interesting way to gauge what was behind those words.

Can you explain how the trap works? The exploit gives you access to the machine which you can then use to wipe the evidence of your intrusion - right? There is nothing to leak by taking control of the machine.

Is the trap theory that this server isn’t really running a vulnerable version of php, and is instead recording all traffic?

Yeah this smells bad. Especially given the box is set up to not accept the exploit (1mb vs 12mb).

Assuming you do have a working RCE - this is some weird game theory. Do it and potentially leak the exploit. Don't do it and you lose control of the narrative/lose your credibility/have people not take the risk seriously anymore (this comment is losing the fight with another comment for top comment, and the other comment is concluding that yeah this proof that the whole thing was overblown).

And then there's the third option that actually this server is unexploitable or there's no wallet or something and simultaneously you give someone the exploit and lose your credibility at the same time. Really no good way out huh?

I have a PoC generated by an LLM that can crash sites using php2shell, but crashing != RCE. The issue is that, to achieve actual RCE, recreating the RCE PoC based on the git diff of the patch and blog posts about php2shell isn't enough. You would still need to develop a working exploit chain, bypass ASLR, and so on to actually achieve RCE.

Also, this site runs Nginx with PHP-FPM, not Apache, which is harder than using mod_php exploit mode for this exploit.

So you would need to develop a working exploit chain and then essentially "burn" it by exposing it to the site owner.

In other words, someone is offering $500 for a working exploit chain.

Sure you do. My girlfriend is a model she just couldn’t come out tonight also. Clown.

[dead]

Your comment makes zero sense. You have nothing :)