frontpage.

We enabled the disease and provided the vaccine!

hmmm not sure about this one, the disease was already there it just available to anynone (not only for state sponsored actors) and the vaccine is globally available at a fraction of what it cost to build it.

The disease is unleashing these powerful AI tools to the public before even thinking about the risks.

The AI economy profits solely off of the broken window fallacy.

Did they actually do anything good here ? Is this really marketing in the middle of this shitshow ?

They found a vulnerability and reported it; isn't that a good thing? Are you suggesting it would be better to just not look for vulnerabilities, hoping that if nobody knows they exist, they can't be exploited?

I thought that logic had been widely discredited in the security community long ago.

Calif found the vulnerability, not OpenAI

Wiz claims they they found it with Gemini? I have no idea who actually found it.

Edit: Apparently both found independently

> Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet initiative

If they can find the vulnerability anyone can. This whole "patch the planet" is marketing trying to cover up for the danger AI is unleashing on internet infrastructure.

Patch the Planet? Not with OpenAI tools.

How much time will be left in the Defender’s Window between now and an organization getting Daybreak Access?

It seems like OpenAI are trying to frame this as if AI did all the work here, but it's not really true given what Calif say (https://calif.io/php2shell/):

> How did we find this?

> No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase. This shows that "know your target" is still as applicable as ever, even in the LLM dominated VR age. No model is simply capable of unearthing "all bugs" with simple prompts. At least for now.

> There are some practical research implications here. LLMs may have ingested public historical vuln data, but in their default variant analysis tends to move from the newest and most prominent bugs toward nearby older code. They do not reliably begin with obscure twenty-year-old exploitation primitives. Keeping your own mental catalog of a target's vulnerability history lets you prompt that direction explicitly.

In 2024 I saw a reddit post answering the question: AI is going to program insert name App.

Response: "What's the prompt?"

Yep. I might take minimum wage interns and make million dollar software(or million dollars in 2023), but they often run into issues that a 5 minute review with me solves.

I do wonder if AI is going to eliminate prompt engineering... It's basically all I have left. I feel like I have magic words.

I can't think of how it'll really eliminate prompting, but needing to carefully phrase your language already seems in the way out? Wasn't one of the prompts leading to solving fields problems just "look for fields problems and try very hard" or the equivalent

The commit $1 billion in tokens to "defenders". $1 billion directly to QA for open source projects [1] which would write 100% code coverage, run ASAN and fuzzers would be more effective.

But of course there would be no marketing.

[1] From whom you stole everything in the first place.

To be pedantic, would that not be marketing?

To be further pedantic, is that really stealing? They are disregarding copyright but was anything taken from anybody? I thought that was the old argument for piracy, ie, nobody was deprived of anything.

It’s marketing, but in a global good will sense of “look how much OpenAI cares about secure open source.”

This works for established profitable brands that want to build / maintain a good public image.

This isn’t the marketing needed by an unprofitable startup that wants to show hyper growth before its IPO. They need the “use our product or get pwned” kind of marketing.

l'IA est simplement un outils ce sont les ingénieurs derrière qu'ils faut féliciter pour leur travail acharné.

Feels like a marketing campaign lol

Point me at anything what _these people do_ that is not a marketing or _confusion_ campaign.

I would simply write code that doesn't have vulnerabilities in the first place.

> 1 August 2026: 2 days after OpenAI invites Calif to join its “Patch the Planet” initiative, Ryan Austin finds the RCE paths, tweets a cryptographic hash on 5 August, and submits the bug and working RCE proof-of-concept to PHP between 11 August and 14 August.

https://deadneurons.substack.com/p/php2shell-explained-php2s...

yes, they sat on a working exploit for 2 months to hone their magic "this exploits everything"-script. In other words: criminals.

>In other words: criminals.

You're not required to disclose bugs, nor is developing exploits a criminal offense (assuming no intent/conspiracy to hack stuff).

No idea what your comment is even about. The researchers that found and reported this did not sit on this for 2 months.

> 1 August 2026 [...] Ryan Austin finds the RCE paths, tweets a cryptographic hash on 5 August, and submits the bug and working RCE proof-of-concept to PHP between 11 August and 14 August.

> 19–24 August 2026: Wiz Research independently collides with the same bug family using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, reporting its variants on 24 August.

I get some skepticism about marketing copy, but your comment is blatantly wrong and needlessly rude.

oh, so you say they only sat on it for a week? And then they exhaustively searched all exploit-paths so they have a demo ready 2 months later?

> so you say they only sat on it for a week?

This is absurd, and it shows that you have absolutely 0 idea of how any of this works. Finding a bug and delivering a working RCE 11 days later is absolutely not "sitting on it". This is how this works. You need time to test, exploit, confirm, and so on. Sorry, but just stop being so negative. This can't be healthy for you.

Pure marketing, it's getting increasingly hard to separate actual technical feats of agents from marketing pretentious declarations. Such a terrible environment to navigate right now.

Not marketing. It is a crime related to fraud or securities fraud.

You're claiming this is securities fraud?

Not only that, but everything else is also securities fraud.

What’s worse is that this is part of a larger strategy of scaring the public to get regulatory capture

It’s just gross

It's not hard tho, the default mode of thinking should be to never trust what a US corporation says.

Why limit only to the US?

> OpenAI are trying to frame this as if AI did all the work here

CEOs of all big corporations are constantly lying and misleading the public, investors and shareholders. That is a crime. A shame that it is not enforced anymore.

PHP 8.2.35

PHP2Shell: AI uncovers critical RCE in PHP

DuckDB 2.0.0 LTS "Cinnamon Teal"

Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds

Patch the Planet: global response coordination as agents uncover vulnerabilities

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

Another day, another GitHub incident

The No Kings Takedown Is Why You Shouldn't Rent Your Megaphone from Zuck

Most advice is right for the person giving it

Qwen3-Coder writes less secure code when told it's for a US persona

LayerFS: The filesystem for AI coding agents

Upcoming critical PHP security release (CVE-2026-109618 / -109619)

9 Mothers (YC P26) Is Hiring in Austin, TX

The Future of CSS

C++ futures part 1: The mental model

Using thousands of AI agents to uncover new leads in biological data

Way to Play Super Mario 64: On Apple Vision Pro

Show HN: SimCity, but with Permits

Muse exposes users' personal and business secrets when they share conversations

eMudhra intermediate CA compromise

Dutch National Cyber Security Center is Offline because it uses PHP

Whatever Happened to Fire Escapes

The Decoherence Trap

Voxtral 3

The Lucrative World of Literary Scams

Feds suspect ransom negotiator ran ShinyHunters extortion site

Good type against all odds

The Other Epidemic: Trying to get off benzodiazepines

Show HN: Sumi.css – CSS Framework

In Hilbert space, all things are quantumly possible

PHP 8.2.35

PHP2Shell: AI uncovers critical RCE in PHP

DuckDB 2.0.0 LTS "Cinnamon Teal"

Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds

Patch the Planet: global response coordination as agents uncover vulnerabilities

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

Another day, another GitHub incident

The No Kings Takedown Is Why You Shouldn't Rent Your Megaphone from Zuck

Most advice is right for the person giving it

Qwen3-Coder writes less secure code when told it's for a US persona

LayerFS: The filesystem for AI coding agents

Upcoming critical PHP security release (CVE-2026-109618 / -109619)

9 Mothers (YC P26) Is Hiring in Austin, TX

The Future of CSS

C++ futures part 1: The mental model

Using thousands of AI agents to uncover new leads in biological data

Way to Play Super Mario 64: On Apple Vision Pro

Show HN: SimCity, but with Permits

Muse exposes users' personal and business secrets when they share conversations

eMudhra intermediate CA compromise

Dutch National Cyber Security Center is Offline because it uses PHP

Whatever Happened to Fire Escapes

The Decoherence Trap

Voxtral 3

The Lucrative World of Literary Scams

Feds suspect ransom negotiator ran ShinyHunters extortion site

Good type against all odds

The Other Epidemic: Trying to get off benzodiazepines

Show HN: Sumi.css – CSS Framework

In Hilbert space, all things are quantumly possible

Patch the Planet: global response coordination as agents uncover vulnerabilities

Comments