Hacker shares the 10 AI prompts he used to cut through the PHP2Shell RCE crisis chaos
Dave_Maynor · x · 2026-11-02
Security researcher David Maynor recounts the chaotic 36 hours around PHP's emergency patches for two CVSS 9.2 RCE bugs (CVE-2026-109618/109619) — wrong CVE timings, an accidentally published PoC video, an early embargo break by Chainguard — and shares the 10 AI prompts he used to verify exploit claims and keep 'confirmed, reported and claimed' strictly separate.
- A leak-prone coordinated disclosure process described by the PHP Foundation as "drama we couldn't write"
- A repeatable AI-assisted workflow for incident fact-checking: cross-validating sources, assessing real exposure, and testing whether config changes buy time
A concrete case study in using AI to separate signal from hype during security incidents.
More from coding & agent
- Qwen 27B orchestrates SAM 3 per tile: one H200 serves 12 patients in medical imaging — MaziyarPanahi · 2026-11-02
- LangChain to host live workshop on context engineering for agent memory — LangChain · 2026-11-02
- VibeCoding pain point: AI-built web tools ignore design systems and break on mobile — lxfater · 2026-11-02
- Open-source insect sticker library ships with agent-run generate-and-review pipeline — AlchainHust · 2026-11-02
- 19-year-old claims $750K profit from Claude Code-built trading bot started with $68 — aftahi_ai · 2026-11-02
- Solo dev vibe-codes a superhero MMO with Opus 5.5 in 6 weeks, burning 3B tokens — superpikapoo · 2026-11-02