On: There isn't an easy exploit for this PHP vulnerability

[quotemstr]

Everyone has evidence of widespread exploit attempts. I totally believe that there are widespread attempts. Where are the compromises?

[vanviegen → quotemstr]

Why would you do attempts on someone else's server if you haven't been able to exploit a local server yet?

[milkshakes → quotemstr]

what makes you so sure these would be publicized? what incentive does an adversary have to be loud about it?

[whizzter → milkshakes]

I wouldn't be surprised about a timeline like

1: Wiz finds the exploit , begins responsible patching procedure

2: Chainguard,etc gets to know about it, adds some monitoring on top of their patches.

3: OpenAI being happy for the upcoming publicitiy starts an automated run to _count_ vulnerable instances for _marketing_ purposes.

4: Chainguard interprets it as wild exploitation and pulls the trigger early.

[milkshakes → whizzter]

lol.

> I wouldn't be surprised

yeah i am not surprised you're not surprised. you seem to have already made up your mind. that said, every single guess you have made here is completely incorrect and not based in facts at all.

literally you have no idea what you're talking about! but don't let that stop you from having an opinion

[quotemstr → milkshakes]

Any particular compromise might not be published. But 70% of the internet is vulnerable. Even with a low reporting rate, wouldn't you expect to see something?

[yorwba → quotemstr]

Surely all the websites that had scheduled downtime for the patch are no longer vulnerable? Would be kind of pointless otherwise.