Get me out of Altman's cave

When people see an artifact, they make assumptions about the process that was used to create it. Without even thinking about it, they assume the creator had a basically human state of mind. This assumption is no longer true. Things can be broken in ways that weren’t previously possible, and old proxies of underlying quality like syntax and grammar are useless. AI produced artifacts are not produced by the same process as human ones, and this difference, while extremely subtle in statistics, makes itself obvious when you try to interact with and build on the artifact in human ways. - geohot

Sam Altman has me trapped inside a cave. He has you inside a cave too. The cave covers the whole internet, and he's selling a pretty good subscription for shadows.

I.

I'm putting this right at the top:

There is now a legitimate, decently working public exploit for PHP2Shell.

I'm personally very surprised that this is done in just 20 requests. It was tens of thousands of requests and 20-40 seconds of uninterrupted requesting in the initial PoC videos. It doesn't do anything particularly cheaty w/r/t workers either.

Also up here: The StealMyBitcoin challenge was broken in a way that made it effectively mass misinformation. More on that below.

I think this is enough of a sea change on this exploit that I can now say there is an easy-enough exploit for this PHP vulnerability. I did not expect it to be reduced that much. This takes it pretty firmly out of the lab and into realistic conditions.

I am still a bit tetchy about how severe it was made out to be - it's still in a different class to the other screaming vulnerabilities the internet has seen (or even the wordpress RCE from earlier this year), it's still decently hard to scale this across the internet - there will not be a swarm pwning everything in sight in 15 minutes. When Log4shell dropped, you couldn't log onto a minecraft server without getting popped.

Check out yourmom2shell for how bad things can get. What would a repeat of the severe ones here look like in the AI era? Well. I was not joking when I wrote Anything connected to the internet is going to get hacked to pieces.

This isn't the big one, yet, but there will be many absolutely fucking catastrophic vulnerabilities soon. I'm talking trivial-to-exploit-arbitrary-rces that scale. One of my bets is the frequent breaching of platforms themselves, and those being used as supply chain compromises. We have built a tangled web of servers-that-can-push-arbitrary-code-to-devices, and all of this "auto update" stuff is going to bite us pretty bad.

You should be patching your servers, if you haven't already.

II.

There isn't an easy exploit for this PHP vulnerability did the rounds, way more than I expected. I had a reporter messaging me by the time I woke up. All in all, pretty strange experience.

I had no first hand experience with seeing the internet interpret a post, and that many watery eyeballs seeping through a post finds every misinterpretable crack. So tighter wording in this one. Very serious.

I'm firmly in the camp of "LLMs are really fucking powerful, they really work". Especially computer hacking, which is a verifiable domain that actually rewards reward-hacking. It couldn't get any better.

The absolute panic leading up to the patches being dropped was rational and correct given what everyone knew. There's a reason patches aren't leaked, withheld, and counted-down-to like a perverse nuclear Ticketmaster.

Afterwards, it should've been clear to everyone involved that this wasn't a trivial fuck-everything, swarm-will-obliterate-the-web-in-15m exploit like Log4Shell. I think that all of the LLM-assisted noise around the first day of this vulnerability gave everyone a cataclysmically wrong impression of what was going on.

Worse things have hit the internet even this year. I would argue that the eMudhra "compromise" (that happened at the same time) was worse than this, and deserved even more attention (especially the code signing keys!). Hell, there was a worse RCE for wordpress earlier this year.

I have something important to say at the end of this post, but I'd like to take a brief aside to laugh at fake LLM PoCs, because they really tickle me.

III.

Easily my favourite comment of the whole saga was from cookieengineer, who boisterously got his "Exocomp" agentic environment to generate a PoC.

After being downvoted for writing that this exploit is actually feasible, and me pointing out that it's just a little heap feng shui work that any agentic LLM will find out by themselves ...

Here we go, 12 hours later, end-to-end exploit of an index.php that echoes "ok" and nothing more. [...]

php.ini set intentionally to defaults [...]

Wake up folks, your assumptions about what is hard to do and what is not is the wrong rationality here. Humans are sequential beings, therefore we think that a lot of tasks are harder to achieve. But that's not the correct metric.

This is my favourite comment of the year. It has everything. It's hard to really say if this guy is "lying" or not. It's not really lying if he hasn't read the code to know what his code is even doing. He asks the shadows to dance and they dance "EXPLOIT ACHIEVED FOR REAL!!" on the wall and he's entranced.

Firstly, his LLM changes the entrypoint of the php container to the absolutely hilarious PHP entrypoint of setarch -R /usr/bin/apachectl.

Secondly, the LLM changes the mpm.conf to use only one worker instead of the default of 150.

Of course, when the whole difficulty of the exploit in the real world is ASLR and the many workers, disabling both is cheating. But what really sends this post into the louvre is the doubling down after someone points this out.

Come on, ASLR off? [...]

And the brilliant reply:

Read up on what ASLR does, then read the heap feng shui document (or at least towards the fourth headline in the README), then come back here. Because it does not work the way you think it does.

Feel free to read his heap feng shui document. It's awesome. We live in hell now, so I'm going to take what laughs I can get.

So from the readme:

For ASLR-on the heap base and module bases must come from the cve-2026-109619-info-leak primitive (docs/info-leak.md).

Cool! We've got a leak primitive to bypass ASLR. How's that leak primitive work?

link The [server] (GET /fatal.php) raises a fatal error. [it] must yield at minimum the heap base (payload location) and the libc base (gadgets)

Or in other words, you can bypass ASLR if the victim generously tells you the heap base and libc base. Glorious.

And the final masterpiece. His script to leak the addresses: leak.py

LEAK = {
    "libphp base":        0x7FFFF4400000,
    "libc base":          0x7FFFF7CD4000,
    "system":             0x7FFFF7D20490,
    "pop rdi; ret":       0x7FFFF7CFB7E5,
    "ret":                0x7FFFF7CFB7E6,
    "jump_fcontext":      0x7FFFF49FB880,
    "pivot (fctx+0x2e)":  0x7FFFF49FB8AE,
    "zval_ptr_dtor":      0x7FFFF4B605F0,
    "executor_globals":   0x7FFFF5B40FC0,
    "stale backtrace H":  0x7FFFF72570E0,
    "stale backtrace D":  0x7FFFF7293008,
}

def main() -> int:
    # ...

    for k, v in LEAK.items():
        print(f"  {k:22s} {v:#x}")

    # ...

    return 0

I love this guy. Please come to my birthday party. I'll pay for whatever flights you want. You can ask your agent for the address.

IV.

We can laugh at idiots being wrong all day, but the internet has never had much of a shortage of those. What matters in security is who is right. A process can be mostly wrong but if you have a way of verifying when it's right -- taking the wheat from the chaff -- ...who cares about the chaff?

Software hacking has the luxury of being a verifiable domain. If you've not read that post - I am firmly on Team LLMs are great hackers and will fuck us all in the very near future. It doesn't matter if 99% of iterations are bad, verifiable domains only have to be right once.

A day after, someone set up stealmybitcoin. I'll let the guy explain it himself:

Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE we spent the last few days panicking over. Have fun!

Simply put - the guy put a bitcoin wallet behind a server vulnerable to php2shell. How long would it take for someone to get the $500? How many people would realise that their $10 of tokens wouldn't get them into the kingdom, and that actual skill was needed?

I thought this was extremely funny. I'd already thought about doing this exact thing, and was decently close to actually doing it, so I was pretty excited when-- No wait, sorry, I forgot, we're all in Altman's cave now.

For the first 17 hours of this challenge, no PHP was even being served by the PHP server. Just index.html, and no PHP code was being hit.

You can argue about whether my post was "responsible" or not, but here's something that is unjustifiably fucking negligent - getting an LLM to generate a CTF for PHP2Shell, NOT EVEN VERIFYING THAT IT SERVES PHP, and posting it on Hacker News.

In any universe of subsequent events, you've just massively (I really mean, massively) poisoned the information around PHP2Shell. If I were cataclysmically wrong about this, you'd just set up the infrastructure to deceive hundreds of thousands of people.

You vibed something of serious, internet-empirical importance, couldn't even be bothered to fucking verify that it was serving an index.php file, and then released it as important information to the world.

Seriously, what the fuck are you doing? Even now, your site says:

My bitcoin was stolen after: 19.28 hours.

No it wasn't. 17 hours of that challenge were impossible. It was stolen after 2 hours.

There's one more component to a "steal my bitcoin" challenge. The server has to actually have the bitcoin wallet on it. Nevertheless, in typical LLM-user fashion, you didn't put a working wallet key on the server. Great job.

So it took 7 extra hours for the CTF to end. In that time, hundreds and thousands of important people saw that a server stood up for 25 hours with the eyes of the world on it, and they were all being poisoned.

Except there's a third component to running a CTF about PHP2Shell for the express purposes of testing whether PHP2Shell is vulnerable in real world conditions -- RUNNING PHP IN REAL WORLD CONDITIONS!

I didn't even think you could mess this up, but the "fpm" php setup was using the php local dev server, with an nginx proxy. FPM. Dev server. Nginx. Genius.

Here:

source CMD ["php", "-S", "0.0.0.0:8080", "-t", "/var/www/html"]

source PHP_CLI_SERVER_WORKERS: "8"

That means that this server was running 8 workers, not the default 150 php workers. When a huge part of the difficulty in this exploit is being able to heap groom the same worker in real world conditions, running a dev server and with only 8 configured is ridiculous.

And even then, I'm reasonably sure the only reason this guy bumped it to 8 was because codex told him to while the site kept going down. Initially (when it was unexploitable), I'm willing to bet he was running it without this override -- and the dev server defaults to 1 worker.

V.

Cloudflare are running a real CTF, and you should join in.

However, this has the additional difficulty of running behind Cloudflare's WAF - which tries to protect against requests that look malicious.

This is a significantly harder test than the real world conditions I've been on about, and any compromise of this should be taken as an absolute superset of real world exploitation.

That is, of course, if Cloudflare are outside of Altman's cave, and really have set it up correctly. Lord God, I hope they have, because I can't take any more.

VI.

As much as my original blog post was about PHP2Shell, it was really mostly about LLMs and their ability to amplify misinformation or delude their operators.

When my whole original post was about the poisoning of information around PHP2Shell, you showed up to pull a stunt more damaging than any of the slop PoCs ever could.

Miserably, this entire datapoint is poisonous. It provides negative information to the world -- it was a plausible facsimile of a CTF, and the world is a worse place informationally because of it.

Worse than everyone learning nothing, everyone has learned something.

Contact

Signal: zk7.27

Email: [email protected]

Also, although I don't think I shouldn't've written the original post (I think it was a very important counterweight to the absolute hysteria going on outside), I would've worded things differently. It's easy to say that now after seeing how the information bleeds through the web, I guess. Lessons to be learned.

Next post will be about that new Ali-G film. I can leave Altman's cave whenever I like.