News for hackers. Stuff that matters.

A comment on After 7 Months, Glasswing Overwelms Maintainers with Underwhelming Findings. Parent comment

Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by tptacek on Tuesday November 10, 2026 @06:58PM (#50448029)
People say this vulnerability was "not super large easy to exploit" because of one poorly-informed skeptical blog post that hit the top of HN, but the evidence strongly suggests that post was simply wrong, and we're just going to have to live with the misinformation until it decays.

At this point the play is simply to move the goalposts, suggesting that vulnerabilities don't matter so long as you yourself couldn't easily exploit them, regardless of what well-armed attackers can do with them. That's, obviously, not how software security works.

[ Parent | on HN ]
Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by snowwrestler on Tuesday November 10, 2026 @07:37PM (#50448341)
Are there better sources for understanding the scope of impact enabled by PHP2Shell? My impression from a variety of sources is that very few incidents can be clearly attributed to that vulnerability. As opposed the many other ol’ ways PHP applications get exploited.
[ Parent | on HN ]
Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by tialaramex on Tuesday November 10, 2026 @07:42PM (#50448379)
> the evidence strongly suggests that post was simply wrong

What sort of evidence? What "strongly suggests" this was actually easy to exploit?

[ Parent | on HN ]
Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by tptacek on Tuesday November 10, 2026 @07:48PM (#50448437)
I'm not interested in arguing with you about whether e.g. Dan Guido is a credible source of exploitation information.
[ Parent | on HN ]
Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by what on Tuesday November 10, 2026 @09:29PM (#50449110)
What a smug reply. Maybe you could just link to what Dan Guido has to say about it that supports your statement and why people should find that credible.
[ Parent | on HN ]
Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by tptacek on Tuesday November 10, 2026 @10:16PM (#50449376)
https://news.ycombinator.com/item?id=50191174
[ Parent | on HN ]
Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by cowlevel on Wednesday November 11, 2026 @01:24AM (#50450281)
The fact that "steal my bitcoin" got its bitcoin stolen within 2 hours?
[ Parent | on HN ]
Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by cowlevel on Wednesday November 11, 2026 @01:24AM (#50450283)
It's quite difficult to exploit. But so are most vulnerabilities, but attackers have figured out frameworks for exploiting hard vulnerabilities of this type. The proof is in the pudding - "steal my bitcoin" had its bitcoin stolen.
[ Parent | on HN ]
Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by grim_io on Wednesday November 11, 2026 @01:34AM (#50450336)
I think the post scan curl post did a lot of damage to the perception of real dangers.

Instead of highlighting the exceptional quality of curl, under intense, unprecedented scrutiny, the maintainer chose to dismiss Mythos as a nothingburger. I think this was a huge mistake and a disservice to curl itself.

[ Parent | on HN ]
Re:After 7 Months, Glasswing Overwelms Maintainers with Unde... by watwut on Wednesday November 11, 2026 @03:26AM (#50450948)
The goalpost here was an apocalypse, thousands instantly hacked sites and hundreds of exploits flying around within hours. I did not made that goalpost. And reality did not hit that goalpost.

> vulnerabilities don't matter so long as you yourself couldn't easily exploit them, regardless of what well-armed attackers can do with them.

This is moving goalpost. The goalpost was not "yet another vulnerability like the others".

[ Parent | on HN ]