Researcher tests PHP CVE PoCs with Claude: exploitation appears non-trivial
cyb3rops · x · 2026-10-21
Security researcher Daniel Card shares lab results testing PHP CVE PoCs with Claude's help. Key findings:
- Exploitation is not trivial: the PoCs target a specific build ("Ubuntu php 8.5.4 profile-21") with hard-coded struct offsets and a build-specific address delta. Vanilla upstream 8.5.4 may not share the same reachable path, and the heap groom depends on that build's allocator state.
- The author is candid that this CVE pair is described in the PoCs themselves as leaked/pre-embargo/"presumed," and cannot be independently verified as a reproducible upstream bug.
A real-world look at AI-assisted vulnerability research—and a caution about leaked PoC claims.
More from Safety
- Sanders calls to pause autonomous AI agents in bank accounts; critics push back — AIandDesign · 2026-10-23
- TechPolicy essay: system prompts are weak evidence of AI safety, outputs must be evaluated — mmitchell_ai · 2026-10-23
- Anthropic's deputy security chief warns cyber threats will get 'a lot worse before they get better' — Polymarket · 2026-10-23
- AI cyberattacks could paradoxically accelerate AI development in an offense-defense arms race — kimmonismus · 2026-10-23
- AI Now's People's AI Assembly spotlights data center opposition and labor rights — AINowInstitute · 2026-10-23
- Cloudflare CEO: Next two years of AI cyberattacks will be terrifying but make the internet more secure — johncoogan · 2026-10-23