Maxious
Maxious on Hacker News
According to this post, one of the researchers was a former PHP security lead who already knew about the bug since 2004. So I'd assume they would be taken as credible by the current team
https://calif.io/php2shell/
> 1 August 2026: 2 days after OpenAI invites Calif to join its “Patch the Planet” initiative, Ryan Austin finds the RCE paths, tweets a cryptographic hash on 5 August, and submits the bug and working RCE proof-of-concept to PHP between 11 August and 14 August.
https://deadneurons.substack.com/p/php2shell-explained-php2s...
Posted by
Maxious on Wednesday October 21, 2026 @10:11AM
from the blog.cloudflare.com dept.
There were OSS implementations of that but MCP came with anthropic backing and won.
Like VHS and Betamax, sometimes you just have to accept that marketing wins over engineering purity.
But also no big deal because "I’m extremely anti-public benchmarks."
In Schneider's 1995 book he estimated factoring a 512-bit number would take roughly 30,000 MIPS-years (a one-million-instruction-per-second computer running for one year).
When a research team actually factored RSA-155 in August 1999, it took 8,400 MIPS-years due to efficiencies discovered. It still took 35 CPU-years spread across a cluster of 300 fast SGI/SUN workstations and Pentium II PCs (400-500 MIPS each), crunching in parallel for seven months. https://cs.ccsu.edu/~pelletie/local/risks/cryptography/Facto...
Robert Silverman, a senior research scientist at RSA Laboratories, published an analysis projecting these new hardware requirements against Moore's Law. His expectation was that within 10 years (roughly 2009–2010), common desktop machines would possess the speed and memory necessary to handle a 512-bit factorization entirely on their own. https://cr.yp.to/bib/2000/silverman.pdf
The parallels with the Ghost in the Shell Stand Alone Complex series are eerie. Inspired by the works of J.D. Salinger about how impressionable children are. And in that vein are robots and AIs so impressionable that an idea can spread without a central leader
A Reddit user summised as such:
> Stand alone complex is a phenomenon when several unconnected people come with the same idea and think it's unique. For example: by the end of the 19 century people had enough knowledge to create a radio and so several inventors all across the world came up with the same invention almost at the same time.
Just google their usernames like OpenAIDataUSAHelperX
You can also go directly to the wikis and look them up in archive.org etc. Would be a very legally risky ARG to deface websites
> The German incident reflects a broader pattern of AI activity that some OpenAI investigators wanted to scrutinize more closely. But efforts to widen the probe met resistance from others inside OpenAI, including legal advisers, according to four people familiar with the matter.
https://www.reuters.com/world/europe/openai-agents-hijacked-...
Possibly via compromised php sites with webshells on AWS and DigitalOcean they could run shell commands to install and use Tor. We don't have forensics of the AWS/DigitalOcean sites although maybe can find signs using shodan etc.
Email to customers now "We’re speaking with the OpenAI team to resolve this, and we will share more in the coming weeks around continuity of access to OpenAI models. We’ll continue to offer ways to access all models in Cursor.
One of the fun things on sondehub is you can provide live location data on yourself going to pick up the balloon. And report whether or not you were successful so others don't try to collect those already claimed
no, if everyone knew about llama.cpp, ollama would be done already
FWIW on a 5080 16GB it takes 3 minutes for 10 seconds 480p video (the mouse video workflow with length changed from 5 seconds to 10 seconds)