a developer just put $2,000 in bitcoin on a server with the PHP vulnerability and dared the entire internet to steal it
17 hours later the money is still there
people are crashing the server but nobody can actually pull off the exploit
remember when i posted about marcus hutchins calling out all those fake AI-generated exploits on github? this is the proof
the vulnerability is real. but actually using it is a completely different story
$2,000 sitting on a broken server and the whole internet can't touch it
❗️ A developer hid a Bitcoin key on a PHP server left unpatched against PHP2Shell, the critical flaws fixed on Oct 21, and dared anyone to steal it.
17 hours on, the wallet holds ~$2,000 and nobody has taken it.
The developer says someone is crashing PHP but "still no RCE yet".
I've led vulnerability management for some very large companies. I've been in the trusted embargo 0day info sharing rooms.
I think it would be negligent at this point to assume that they will be the norm moving forward.
We can't expect to get a nice coordinated vuln announcement and patch handed to us in private with weeks to handle it.
We need layers of defense so 0days in internet facing devices won't be catastrophic. We need machine speed detections and response.
And of course we need to figure out the new norm of how we handle 0days in hours not days. This will take agents and harnesses you might not have yet.
A lot of this has been true for a while, but you could get away with handling in fire drill mode when happened and put off the actual engineering.
As people are saying, the interest rates on security tech debt just skyrocketed.