logoalt Hacker News

weird-eye-issue • today at 4:52 AM • 2 replies • view on HN

That's interesting because there were people complaining yesterday that this was a fully static website with no PHP involved lol

Replies

unsnap_biceps • today at 5:24 AM

https://news.ycombinator.com/item?id=50234254

    OP confirmed that the server was initially serving only an index.html. In that configuration, the vulnerable code path is never reached — it requires a .php file.
    OP added php-version.php roughly 18–19 hours into the experiment (I'm not sure of the exact timing), so that period should be subtracted from the publicly displayed challenge duration.