Hacker News

Why are you framing it like this? Did they create this vuln and how did they force people to pay for a fix?

Before I forget: Sam Altman will need a lock of your hair, a blood sample, and first you will need to breathe into this tube and say “my voice is my passport.”

I assure you this is perfectly formal, and for your… “safety”.

didn't think we'd win the race to the bottom of rent-seeking, but humanity's ingenuity for self-destruction continues to astound me. Einstein was right as always.

there was a post recently on a guy that was posting fake stats in order to prove that llms can be tricked

similarly OpenAI was born out of the idea that the tech will exist and that they should be the oned to decide how it exists instead of other bad guys

I think if you do something you did it, imagining another bad guy doing it is not a great defense.

Unless the magical code generation machine can update packages that are no longer being updated, this isn't really a problem that can be solved with magical code generation.

people running "older versions that no longer receive security updates" are unlikely to update to some new patch-stream from this tooling, because they're already not maintaining their infrastructure.

no. I think they mean how to navigate the non technical organizational challenge, not how to technically fix the thing

it’s a quite simple matter to fix a bug once it’s discovered, but how to deploy and where to deploy it when it affects a supply chain?

here’s an example: you can submit a vuln at a downstream dep and they can tell you it should be patched upstream. what should you do? open an issue upstream? maybe, probably not, probably the solution is to contact all downstream deps in order to get them to migrate dep or patch, because you just reported a vuln and they shrugged it off

They literally open by saying Calif used GPT 5.6 Sol, which is a widely available model. Yes, the person driving did more than "find all the bugs", but nowhere does OpenAI imply otherwise.

Pure marketing, it's getting increasingly hard to separate actual technical feats of agents from marketing pretentious declarations. Such a terrible environment to navigate right now.

OpenAI: your misfortune is our PR opportunity

> OpenAI are trying to frame this as if AI did all the work here

CEOs of all big corporations are constantly lying and misleading the public, investors and shareholders. That is a crime. A shame that it is not enforced anymore.

Just more IPO shilling from the scam-man.

I'm as frustrated as the next open source maintainer, but "stole" goes too far. We gave that code away with pride, knowing the world would be a better place.

To be pedantic, would that not be marketing?

To be further pedantic, is that really stealing? They are disregarding copyright but was anything taken from anybody? I thought that was the old argument for piracy, ie, nobody was deprived of anything.

7.x versions have patches thanks to Mr Sury. Was almost as fast as the patches with official support.

The marketing around the response I would bet is the main reason why they couldn't keep it secret.

OpenAI has the opportunity to do the funniest thing: "Ooops, our AI escaped containment again but this time it's going around and patching security vulnerabilities as a benevolent public service. It's smarter than us and we have no choice but to let it do its thing."

Brilliant! Why hasn't anyone thought of this?

> auto-patching even systems they don't own

It's been done before, though I cannot recall specific examples. Maybe as far back as the Morris worm?

That's not what it does. `php --version` may well not report the php version that's actually running.

Not very shocking that OpenAI wants you to use tokens

lol, I went to the repo expecting to see some more detailed skill, that has instructions on checking various things/PHP install locations/things that could be using PHP that need to be checked, webservers, docker containers, etc/instructions for checking various php deployment methods on cloud providers/etc... i.e. making the skill useful so that it can check lots of places.

Nope, it just says to run php -V and has a table of vulnerable vs non-vulnerable versions.

Sigh

There are lots of people who have underwent a lobotomy since discovering slop machines and have delegated literally all their work to them, so much so that calling `php --version` is too much for them.

People stuck working at companies with slop machine usage mandates will appreciate that skill too.

Well tbh, I know people who graduated 3 years go, got a job, worked and even got promoted as SWE who dont know the basic commands of an OS. I recently had an EE with a senior position admit to me they dont know how to use grep because they've been relying on llms since they got out of school.

Lots of the tech world, especially the younger side is completely reliant on these things for every little thing. Im not exaggerating either.

The AI economy profits solely off of the broken window fallacy.

hmmm not sure about this one, the disease was already there it just available to anynone (not only for state sponsored actors) and the vaccine is globally available at a fraction of what it cost to build it.

They found a vulnerability and reported it; isn't that a good thing? Are you suggesting it would be better to just not look for vulnerabilities, hoping that if nobody knows they exist, they can't be exploited?

I thought that logic had been widely discredited in the security community long ago.

> 1 August 2026: 2 days after OpenAI invites Calif to join its “Patch the Planet” initiative, Ryan Austin finds the RCE paths, tweets a cryptographic hash on 5 August, and submits the bug and working RCE proof-of-concept to PHP between 11 August and 14 August.

https://deadneurons.substack.com/p/php2shell-explained-php2s...

yes, they sat on a working exploit for 2 months to hone their magic "this exploits everything"-script. In other words: criminals.

You're absolutely right! It's not that AI is actually solving any problems, it's that this marketing is a load-bearing part of OpenAI's profit strategy.

Point me at anything what _these people do_ that is not a marketing or _confusion_ campaign.

I can't think of how it'll really eliminate prompting, but needing to carefully phrase your language already seems in the way out? Wasn't one of the prompts leading to solving fields problems just "look for fields problems and try very hard" or the equivalent

Yeah, I was explaining this as magic words. It seems like knowing `pandoc` means you can convert any kind of document into any other kind of document.

Knowing uv means you can scaffold any python project. docker lets you build any infrastructure kit.