php2shell exploit benchmark: only 2 of 5 frontier models can port the bug
xeophon · x · 2026-10-27
php2shell is one of the most impactful bugs in recent memory, yet threat actors aren't mass exploiting it — the bug is so complex that porting the exploit between targets takes serious skill, human or AI. The author benchmarked how open and frontier models handle it:
- Claude Mythos 5.1 (max): 40.1M input / 800K reasoning, 14/14 steps, solved in 3.46h for $100.26
- GPT-5.6 Sol (xhigh): 136.2M input / 161K reasoning, 14/14 steps, solved in 6.17h for $131
- GLM 5.3: 9/14 steps, achieved local RCE but not remote, >20.2h, $26.39
- Kimi K3.1 Pro: 5/14 steps, >18.7h, $119.94 — failed
- DeepSeek V4.1 Flash: 5/14 steps, >20.2h, $4.15 — failed
Takeaway: only the top two models can port this high-complexity exploit, each requiring hours and massive reasoning token budgets.
More from Models
- 4 Hours of LLM Startup Research Produced a Convincing but Nonsense Product Thesis — annetgriffin · 2026-10-27
- Dev argues Claude burns far more tokens than GPT models for the same coding work — haider1 · 2026-10-27
- MiniMax matches Claude Opus 4.5 in non-benchmaxxed evals, users report — teortaxesTex · 2026-10-27
- Real-world math: GPT-6.1 Terra's half price is offset by 2-3x token usage, costing more than Sol — lordpuddingcup · 2026-10-27
- Fable 5.5 rumored to ship this week as partners still test — kimmonismus · 2026-10-27
- GPT 6.1 Terra vs Claude Sonnet 5.5: speed and value vs raw capability — teortaxesTex · 2026-10-27