One prompt found pre-auth PHP RCEs: agent-guided vuln hunting timeline
chrisrohlf · x · 2026-10-23
Dan Lorenc shares a real agent-assisted vuln hunt kicked off with a single prompt — "let's look for pre-auth RCEs in PHP" — using Claude Code (Claude Mythos 5.1) driving a custom harness that runs agent-guided tree search across a codebase inside microvm sandboxes with full source and transitive dependencies. The harness was built by feeding Claude Project Zero blog posts and having it replicate their methodology.
The attached timeline shows an 8.5-minute run: first finding at 2:18, fault record (3/3 crashes on php-fpm and Apache) at 5:35, working RCE on both stacks at 7:44, confirmed three times by oracles, closing at 8:31 with the surface exhausted by success. His message: take agent-assisted scanning seriously.
More from coding & agent
- Terminal-RSI lifts Qwen3.8-27B from 51.7% to 86.52% on Terminal-Bench, plus 70 tok/s on M5 Max via DFlash 2 — udmrzn · 2026-10-23
- NVIDIA Launches Verified Agent Skills to Bring Capability Governance to the Skill Layer — bradneuberg · 2026-10-23
- Cognition open-sources Devin agent plugin to patch the day's CVE wave — Scobleizer · 2026-10-23
- Fine-tuning models solo with a Grok bot and rented GPUs — Rasmic · 2026-10-23
- AutoRouter launches beta: auto-routes each coding task across Claude, GPT and other models to cut token spend — floguo · 2026-10-23
- How Speak uses GPT-Live and a Decisions API for ultra-responsive live AI language tutoring — pbbakkum · 2026-10-23