So you are therefore arguing for the author's point.

The entire exercise is to counter the claim that AI means every script kiddie with tokens can just have their AI create an exploit, and then have their AI scour the internet for vulnerable endpoints. If that were true, then the exploit has very little value, because everyone could make one.

In addition, the claim is that these exploits will all immediately have a thousand bots using them to exploit every possible website, and you can't leave your website vulnerable for a second or it will immediately be owned.

The fact that that hasn't happened to this server already proves the point. Whether professionals can create an exploit from the vulnerability was never the question.

My favourite actively unreleased 0 day exploits are the ones that are released, 5 days old, and allegedly so trivial to exploit it costs $5 in tokens.

No, I will not spend $5 in tokens to claim your $1000 bounty. My $5 exploit is worth more than $1000. Thank you very much.

I suppose it may not be there for actually taking it, but it does serve as a good demonstration of the realistic risk for average people running relatively low-value PHP sites. If nobody thinks it's worth the risk of exposure for a quick and easy $1k in Bitcoin (at the time I'm writing this), why would anybody bother hacking a site that's basically worthless, like the dinky little Wordpress blog I run?

This does effectively make the statement that, there probably are exploits out there for this, but even with a non-updated version, you're not at much risk unless someone with serious resources thinks they can make pretty big money from compromising your thing.

You would have a point if it was still a 0 day. The patch is out, and open source. Anyone who cares has a bunch of the pieces for putting together their own exploit.

Zero days are valuable and kept in the bank to avoid detection. That ship has sailed.

I never mentioned unreleased private exploits, I mentioned what every thought leader and popular creative wants us to believe right now.

The whole point was someone could throws some cents and hack the site.

It’s not a 0day it’s now 5 days and counting since disclosure. Nobody is gaining value sitting on an exploit for a vulnerability which is being actively patched.

This logic doesn't work here, because it relies on the premise that you alone potentially have an unreleased zero-day exploit, which is not the case.

If prompting an AI could exploit this for less than $500 in token spend, then you should immediately do so, since if you don't, in a few minutes' time someone else will.

> The value proposition isn't there.

That's part of the point. $500 or $1000 is a trivial amount. Since the money is still there, there's currently no trivial exploit.

> requires actively utilizing an unreleased 0 day exploit on a server that will certainly be able to track exactly what was done

Depending on the exploit, and the visibility stack on the server, one may or may not be able to determine how the rabbit got in the hat.

exactly. the pros are not going to reveal their hand for $1k

Wallet address is there, you can donate