The value proposition isn't there.

If you reframe the perspective from 'free $500 sitting on a server' to 'requires actively utilizing an unreleased 0 day exploit on a server that will certainly be able to track exactly what was done, for a payout of... $500?'

That's pennies for something like this.

Add two zeros and it might get nabbed.

Edit: others have pointed out it's not really a 0-day anymore, they're right, so it's likely more a matter of time.

▲

cortesoft 3 hours ago | parent | next [-]

So you are therefore arguing for the author's point.

The entire exercise is to counter the claim that AI means every script kiddie with tokens can just have their AI create an exploit, and then have their AI scour the internet for vulnerable endpoints. If that were true, then the exploit has very little value, because everyone could make one.

In addition, the claim is that these exploits will all immediately have a thousand bots using them to exploit every possible website, and you can't leave your website vulnerable for a second or it will immediately be owned.

The fact that that hasn't happened to this server already proves the point. Whether professionals can create an exploit from the vulnerability was never the question.

▲

ufmace 4 hours ago | parent | prev | next [-]

I suppose it may not be there for actually taking it, but it does serve as a good demonstration of the realistic risk for average people running relatively low-value PHP sites. If nobody thinks it's worth the risk of exposure for a quick and easy $1k in Bitcoin (at the time I'm writing this), why would anybody bother hacking a site that's basically worthless, like the dinky little Wordpress blog I run?

This does effectively make the statement that, there probably are exploits out there for this, but even with a non-updated version, you're not at much risk unless someone with serious resources thinks they can make pretty big money from compromising your thing.

▲

stouset 3 hours ago | parent | next [-]

That's always the case for a novel exploit. There isn't a lot of value in popping somebody's PHP blog, so people who've invested time and money into a zero-day exploit have little incentive to use it for that purpose.

The white hats want to extend the time before an exploit is in the hands of the masses who might do so just for the fun of it, and the black hats want to use it on high-value targets.

	▲	ufmace 3 hours ago \| parent [-]
		I think the point is that this is completely the opposite of the narrative that was pushed about this bug - that there would be thousands+ of AI agents actively compromising every vulnerable site automatically regardless of value within minutes of the fix being released into the wild. Well, now it's 3 days after, and this has been up for 3.5 hours, and nobody has taken it yet.

▲

testaccount28 3 hours ago | parent | prev [-]

random sites generally don't log carefully, or watch their logs if they do. so the risk to hacking them is low. this site almost certainly logs very aggressively. so the risk to hacking it is high.

based on differential risk, attackers will choose targets differently. they might reason that the risk/reward on this obvious trap is not worth it. but on joe shmo's php emporium, the reward is less, but so is the risk, and it might pencil out.

▲

zkldi 3 hours ago | parent | prev | next [-]

My favourite actively unreleased 0 day exploits are the ones that are released, 5 days old, and allegedly so trivial to exploit it costs $5 in tokens.

No, I will not spend $5 in tokens to claim your $1000 bounty. My $5 exploit is worth more than $1000. Thank you very much.

▲

gbingles 3 hours ago | parent | prev | next [-]

You would have a point if it was still a 0 day. The patch is out, and open source. Anyone who cares has a bunch of the pieces for putting together their own exploit.

Zero days are valuable and kept in the bank to avoid detection. That ship has sailed.

	▲	3 hours ago \| parent [-]
		[deleted]

▲

technion 4 hours ago | parent | prev | next [-]

I never mentioned unreleased private exploits, I mentioned what every thought leader and popular creative wants us to believe right now.

▲

ls612 3 hours ago | parent | prev | next [-]

It’s not a 0day it’s now 5 days and counting since disclosure. Nobody is gaining value sitting on an exploit for a vulnerability which is being actively patched.

▲

jgalt212 4 hours ago | parent | prev | next [-]

> The value proposition isn't there.

That's part of the point. $500 or $1000 is a trivial amount. Since the money is still there, there's currently no trivial exploit.

> requires actively utilizing an unreleased 0 day exploit on a server that will certainly be able to track exactly what was done

Depending on the exploit, and the visibility stack on the server, one may or may not be able to determine how the rabbit got in the hat.

▲

6thbit 3 hours ago | parent | prev | next [-]

Wallet address is there, you can donate

▲

paulpauper 4 hours ago | parent | prev [-]

exactly. the pros are not going to reveal their hand for $1k

	▲	technion an hour ago \| parent \| next [-]
		Why not? Those pros have their opportunity to use this exploit dwindling by the hour as news of this and pressure to patch grows and grows. All the major managed hosting companies had this patched in the first 24 hours.
	▲	girvo 3 hours ago \| parent \| prev [-]
		That is sort of the point I thought? There’s no low skill exploit for the script kiddies to use even with AI, otherwise they’d happily use it The pros have RCEs, but won’t burn it for something this small. It’s a real vulnerability, but a complex one