At the end of 2006, PHP security expert Stefan Esser left the PHP Security Team¹. That was almost twenty years ago. Esser left because he said he “found it impossible to improve PHP security from within”. Any kind of critical discussion of PHP’s security model would cause one to be shunned by the other developers, he said. Instead of making the software better, people in the project would concentrate on semantics, calling him rude and then ignoring his fixes, Esser reported. He left the project in frustration.

As it turns out, in 2004, Esser had found one of the underlying problems that would later cause the PHP2Shell debacle. In July of that year, he reported on a fix for it. But that, obviously, wasn’t the whole story. As it turns out, the security research company Esser works for now, Calif.io, kept at it and actually discovered the new vulnerabilities in August of this year — apparently shortly before their rival hackers from Wiz did. Here’s the full write-up on the Calif site. Yes, security vulnerabilities have comics now. 🫣

How did we find this?

No special harness, or access to models that weren’t generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase. This shows that “know your target” is still as applicable as ever, even in the LLM dominated VR age. No model is simply capable of unearthing “all bugs” with simple prompts. At least for now.

↵ Back to home