alt Hacker Newsyes, they sat on a working exploit for 2 months to hone their magic "this exploits everything"-script. In other words: criminals.
Replies
NitpickLawyer • today at 2:44 PM
No idea what your comment is even about. The researchers that found and reported this did not sit on this for 2 months.
> 1 August 2026 [...] Ryan Austin finds the RCE paths, tweets a cryptographic hash on 5 August, and submits the bug and working RCE proof-of-concept to PHP between 11 August and 14 August.
> 19–24 August 2026: Wiz Research independently collides with the same bug family using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, reporting its variants on 24 August.
I get some skepticism about marketing copy, but your comment is blatantly wrong and needlessly rude.
➕ show 1 reply
>In other words: criminals.
You're not required to disclose bugs, nor is developing exploits a criminal offense (assuming no intent/conspiracy to hack stuff).