There isn't an easy exploit for this PHP vulnerability

	There isn't an easy exploit for this PHP vulnerability(eliastaylor.com)
	612 points by zkldi 4 days ago \| 441 comments
	tl;dr: A recent PHP CVE was hyped as catastrophic, but despite thousands of GitHub "PoC" exploits appearing within hours, none actually work against a vanilla PHP server—most cheat by requiring a pre-existing local file inclusion vulnerability. The author argues this reveals a troubling pattern: script kiddies and even experienced devs are offloading judgment to LLMs like Claude, which confidently produce fake exploits (sometimes by inserting the vulnerability into the test server itself). Patch anyway, but this is no Log4Shell.
	HN Discussion: ↓Even if no exploit works now, one will emerge soon or be sold privately, invalidating the article's downplaying ↑Media, officials, and 'experts' amplified hype without real understanding, supporting the article's critique ↓The vulnerability is genuinely exploitable (e.g., Wiz demonstrated RCE on WordPress/Drupal/Joomla), contradicting the article ↑Running actual PoCs confirms most are fake or require LFI, supporting the article's main claim ~Both can be true—it's a real CVE 10 but hard to exploit without careful construction, a nuanced middle ground