Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • I'd expect the amount of money paid for exploits to go down then. It's inefficient to pay >$25 for an exploit that took $25 to make.
    by barbazoo
  • This assumes those who'd pay $500k don't have the skill to use GTP5.6 for the same purpose themselves?
    by cromka
  • People who make the money are not necessarily the people who can write the best code.

    Elon Musk didn't write code for a rocket, he hired people who could.

    by khurs
  • You read articles regularly about how X authority is provided cloud LLM history and uses it as evidence to prosecute a defendant.

    Yet you think professional criminals are too stupid to launder their activities through an unscrupulous yet legal intermediary?

    by cheschire
  • Then why didn't we see the same writeup earlier? If you look through the writeup, you still need the skills to go through what the LLM gives you and actually create a valid proof of concept.

    I've been using LLMs to find security vulnerabilities and there is no way I can just submit what I found and call it a day (many try).

    by elmer2
  • > Is GPT5.6 Sol Superhuman?

    This is not a simple y/n question. Computers have been superhuman at playing chess for decades now. Reading this article, I guess they are superhuman at understanding code now as well.

    by ifdefdebug
  • > Computers have been superhuman at playing chess for decades now.

    And at doing arithmetic for even longer /i

    by chrisjj
  • So they spent the $25. But the real question here is did they get the $500K?
    by aussieguy1234
  • Probably not. The Wordpress Bug Bounty program pays very little. Exploit brokers will pay 500K, but we wouldn't be seeing it here if it was sold.
    by elmer2
  • Unquestionably they did not.

    Their listed pricing was up to $50k.

    https://cyber-peace.org/wp-content/uploads/2017/09/ZERODIUM-...

    And that was before LLMs could produce these at volume.

    The demand (dollars) does not go up commensurately with the supply. So today maybe $500 or a few thousand. Maybe not even that.

    by az226
  • One of my websites was hacked with this, luckily not one with any users at all.

    They did this:

    - Two admin accounts in the database.

    - plugin dir: wp-content/plugins/wp-core with remote command-execution web shell wp-core-[12 random chars].php

    - firewall.php backdoor in mu-plugins dir with admin on GET ?sergei

    - cache-seo-helper.php backdoor

    - fixer.php which renames the wordpress version number to one which is patched.

    I have decided to give up on Wordpress.

    by secretslol
  • The author lost me at the last bit where they started using weird names for the posts. Why would you make one ID O and the other ID 0? Why single letters and not EMBED_01? Why seemingly random letters instead of ABCDEF? Does OCPDST stand for something?
    by lexicality
  • They are placeholders, their meanings are spelled out in the post:

        O: publish/oembed_cache, empty content, stale timestamp with parent C
    C: future/customize_changeset, changeset JSON with parent C
    P: draft/page, with parent D
    D: parse/request with itself as its parent
    S: publish/post, for providing embed data
    T: publish/post, containing the outer embed
    by moebrowne
  • I feel like I've seen plenty of non-AI, pre-2020 SAST tools catch SQLis like the one mentioned here, and if nothing else, then a code review ought to catch it. Is WordPress not using code reviews and/or SAST?
    by lillesvin
  • They would not catch it, it requires combining multiple vulns.
    by f311a
  • Interesting write-up and I do think LLM assisted/powered exploit disclosure is a real concern (I've been able to get models to create container breakouts from Linux LPEs relatively quickly).

    One thing I'm surprised about is that GPT-5.6 didn't block that prompt due to guardrails. My experience is that GPT-5.5 and up does not like offensive security work (similar to Opus 4.7+/Fable).

    I didn't notice it but I'd assume that the authors have some level of cyber approvals from OpenAI to relax the guardrails a bit.

    by raesene9
  • This might help https://chatgpt.com/cyber ease the guardrails a bit.
    by Santas
  • The surprising (and possibly untrue) thing is the high price of canned vulnerabilities. WordPress is known as the remote root shell with a blogging feature.
    by ahartmetz

  •   WordPress is one of the most hardened targets of all time
    that obsolete code did not change for decades. all the bugs have been discovered and patched
    by slim
  • some statistics point to almost 50% of all websites on the internet running on Wordpress, $500k for an undisclosed 0day unauthenticated RCE doesn't seem so unrealistic to me
    by lyu07282
  • Propably untrue, the only way to know is to do threat intelligence, and inflitrate those telegram groups where these brokers operate, I doubt the writer of the article did that. Maybe he conflated any vulnerability with a 0-day one?
    by gorszon
  • I still don't understand why, for a blog, a static page isn't enough - especially since most of the WordPress issues are "solved" by adding caching.

    I do understand it from an user perspective (it's easier to tell the average user to drag and drop rather than committing to a GitHub repo and letting hugo build the website), but from a security standpoint WordPress is really just waiting for a vulnerability (either in the core or on the thousands of plugins) in order to unlock its RCE-as-a-service functionality.

    by denysvitali
  • I am so done with FOMO writing. Sure man, you found one with $25. With $25 plus your entire industry domain specific knowledge of where to look, of how to probe, of what else you may have accumulated and collected over the years of working within this industry. Let's stop with the gambling narrative and the illusion that we are all missing out.
    by hmokiguess
  • I can't agree with this more. May cooler, more compassionate minds prevail.
    by recitedropper
  • And nobody would post "I did it for free!" if they had done it themselves, but somehow spending $25 on tokens changes how we're supposed to look at it
    by deaton
  • Should also note the math done on the token costs. $25 of subsidized tokens because he's on a subscription plan.
    by paodealho
  • I agree. This is so toxic! It feels like the Instagram of articles. "Look how my life is great" - yeah sure, you're posting only happy moments.

    Not only $25 is not accounting the years of experience, but also all the failed attempts.

    by w4yai
  • https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa...

    String concatenation SQL injection in the year 2026.

    by progbits
  • >>Principal Software Engineer @ Bluehost. WordPress Core Committer. Baseball fan.

    hmm yes, definitely. You are the principal.

    by m00dy
  • Ahhh very interesting! Thanks for pointing this out, I saw an attack against one of our sites this weekend using this exploit.

    > data: {'requests': [{'method': 'POST', 'path': 'http://:'}, {'body': {'requests': [{'method': 'GET', 'path': 'http://:'}, {'method': 'GET', 'path': '/wp/v2/widgets?author_exclude=1%29+AND+1%3D0+UNION+ALL+SELECT+0%2C1%2C0x323...

    by SpikedCola