AI Codex Builds Complex PHP Exploit Chain in Under an Hour, Raising Security Concerns
jedisct1 · x · 2026-08-05
A security researcher used OpenAI Codex to build a real-world WordPress privilege escalation chain (wp2root) in under an hour—a task that typically takes a skilled operator weeks to craft manually.
The writeup details the full attack path: starting from an unauthenticated remote code execution flaw in WordPress core (wp2shell, originally found by GPT), breaking out of the locked-down PHP interpreter, and achieving native root access via a widespread 2026 Linux kernel bug (Copy Fail).
The author notes that hacking is shifting toward writing clear English prose to direct the model. However, they raise a critical concern: if AI handles the execution, how will the next generation of security professionals develop the deep intuition and understanding that comes from manual work?
More from coding & agent
- Google Open-Sources Gemini API Skills, Boosting Agent Code Generation to 96% — patloeber · 2026-08-05
- Malicious GitHub Repo Disguised as Crypto Exploit Exposed via LLM-Assisted Review — RSync25 · 2026-08-05
- AI Agents Automate Competitor Analysis and Influencer Marketing Strategy — fekdaoui · 2026-08-05
- Opinion: AI Coding is Manageable, but AI Workflows Risk Becoming Slop Without QA — oran_ge · 2026-08-05
- /human-review: Give AI Feedback Like Editing a Google Doc — petergyang · 2026-08-05
- Developer Recreates Pacman Entirely from AI-Generated Binary Code — Dimillian · 2026-08-05