A widely shared PHP vulnerability is drawing attention, but the author argues it is far from easy to exploit. Despite thousands of proof-of-concept exploits on GitHub, the author found that none of them work against a vanilla PHP instance when run directly in Docker.
The author contrasts this bug with infamous flaws such as Log4Shell, Heartbleed, Shellshock and the YAML decoding issue, all of which were quickly weaponized by botnets within hours of disclosure. Most of the PHP proof-of-concept code, the author notes, depends on local-file-inclusion (LFI), meaning the target server must already contain a separate vulnerability that lets attackers read files. The author says that requirement makes this a far less severe bug than headlines suggest.
The author also blames AI tools for spreading exaggerated claims. Many people, the author argues, assumed large language models would instantly build working exploit chains from the patch diff, and some proof-of-concept code appears to have been generated this way, sometimes modifying the test server to be vulnerable.
The author adds that widespread reliance on tools like Claude and GPT is producing uniform design and judgment decisions across the industry. Still, the author stresses that the flaw is real and matters, and that the current evidence simply does not show a ready-made, widely usable exploit.
Source: Hacker News · Summarized by HeadlinesBriefing