Not sure that logic really holds up. If the cost of trying is low, why wouldn't you?

This is where I am, currently. There's a lot of talk about the low opportunity-cost here, but I think that relies on the assumption that there also isn't a single opportunistic person out there with access to the RCE. That doesn't strike me as a strongly supported assumption, in my experience.

For all I know, it's a straight up scam. Someone already sent more bitcoin to the address to double the bounty.

Well, it wasn’t!

Shouldn’t the expected value of attempting this somehow include the likelihood of the key actually being on the machine? Surely the probability is much higher than 0? I would guess the expected value for actually being the first one is around $300, not 0

> Surely the probability is much higher than 0

I genuinely have no idea how to even start calculating this probability. How would we do it? Is there reliable data on honeypots?

You may need to brush up on your game theory. It's worth it to spend $1 for a 1% chance to win a million dollars. You don't need to be certain the key is there for it to be worth it to do a supposedly trivial exploit.

Your giving away the exploit though so it's not really only $1. How much is having it actually worth, probably more then that, probably more than $500 too.

The exploit is supposedly so trivial that everyone needed to take down their services until they could patch? There should be nothing to give away here, which I think is the point. Either it’s trivial and you swipe the $500 or it’s not and you save it (assuming you have it). In the latter case you shouldn’t really be worried, since they won’t burn an exploit on you either.

lol the exploit is patched, why are people acting like it's a a zero-day? anyone you attack with this, in any case, has to be someone who hasn't yet upgraded their PHP version. it's worth nothing to hide/sit on.

what a pedantic way to look at the world