After the smoke cleared from the smouldering rubble, and we rubbed our eyes open, gazing upon the TOTAL THERMONUCLEAR ANNIHILATION that was unleashed upon us last week, the HOLOCAUST-POCALYPSE that reduced THE ENTIRE INTERNET to smithereens, two bands of survivors began to argue about whether PHP2Shell was in fact much ado about nothing.

Perhaps it was an overreaction, argues the first faction.

https://eliastaylor.com/noexploit/
>There isn't an easy exploit for this PHP vulnerability

>If you take a look at github right now, there are thousands, literally thousands, of "PoC" exploits for this vulnerability. One thing you'll notice about all of them though, is that they do not work against a vanilla PHP instance.

>It's been 10 hours since this vulnerability has been posted, and half the software world is looking at it, and lord knows 100,000 people have got their "superintelligence" on the case. Nevertheless, there's no working exploit. The ones doing the rounds are fake, or only work in a lab, because...

Hm? Well, let's take a look at one of these AI generated 'exploits'.

https://github.com/ikow/php2shell-poc/blob/main/lab/setup.sh#L31-L37
>"LFI sink — simulates real-world include vulnerability"
- LLM

>It's not rare for PHP apps to be fucked in some sense, but requiring the server to have an existing vulnerability where users could cat /etc/password is an insane pre-requisite. If you need this, this does not make this a severe bug.

Nuff said.

The "this is all a big overreaction" crowd felt pretty confident that this was indeed mass hysteria. Some suggested that this was the beginning of a trend of AI maxis hyping up the capabilities of their models for investor attention. Still more say something even more Machiavellian is taking place.

They suggest that the Government and the large AI companies are manufacturing a crisis, in order to further restrict the internet - the internet is no longer safe because of "swarms of predatory AIs" that will hack and destroy all websites, and thus, not only must open source models be banned, but the internet itself must be locked down for our own good.

These talking points spread around the internet. Soon it was being reported as fact that there really were swarms of autonomous AI agents that were backdooring every PHP website in existence.

One man decided to put it to the test: https://news.ycombinator.com/item?id=50224916

>Show HN: Steal My Bitcoin
> There is a bitcoin key hidden on this server worth about $502.

> It is accessible to the PHP user account through the print-flag binary.

> This PHP version was selected from before the PHP2SHELL CVEs were released.

> First person to get the wallet wins. If you don’t need the money, consider donating it to those who do: givewell.org.

19 hours later... and the terminator army still hadn't taken the bitcoin.

Nevermind, the site just updated. The bitcoin was stolen!

>https://github.com/KillaBoi/StealMyBitcoin-PoC
>One live PHP callback against the Steal My Bitcoin challenge, start to finish, in a single standard-library Python file.

So, did the doomsayers get the last laugh? Was the hysteria justified?

Maybe. Or perhaps the creator of the StealMyBitcoin challenge, purposefully or not, made his setup more vulnerable than it otherwise would have.

>To be fair, the person who created the challenge stated that is was a fairly standard setup, replicating something outside a lab, but in reality is was something completely different, and not anywhere near how PHP is usually used.

>It used the development server in PHP, and did not even run requests with fpm or mod_php. Instead, it used the built in dev server of PHP, and just proxied requests from nginx to the php dev server.

>Literally the first thing on top of the PHP docs about the dev server used here is this: "Warning This web server is designed to aid application development. It may also be useful for testing purposes or for application demonstrations that are run in controlled environments. It is not intended to be a full-featured web server. It should not be used on a public network."

>That is not something people do, and it also explains why the site was down all the time, cause the dev server is super slow, as it's not meant for this in any way shape or form. A real setup would add a few zeros to the requests per second a server could handle.

The jury is still out. Did we all run into our bunkers, screaming, crying, and pissing our pants for a good reason? Or did we all get a little too worked up?