alt.hn

7/20/2026 at 8:13:36 AM

I found a WordPress RCEs with GPT5.6 and $25

 https://slcyber.io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6/

by infosecau

7/20/2026 at 11:47:23 AM

There is no evidence that $500k has been paid or would be paid for an exploit like this one.

Given that the article says that prompts are modified like they are holy scripture, perhaps sell the prompt for $500k.

The author works for https://www.assetnote.io/ , which has AI products for automated scanning.

by Zsfe510asG

7/20/2026 at 12:09:24 PM

Likely referencing https://www.crowdfense.com/exploit-acquisition-program/

Zerodium used to offer up to 300k in 2021 https://www.securityweek.com/sites/default/files/images/Zero...

These brokers usually don't pay the bulk sum - they sell access to nation actors and you get payed out over time as long as the bug is not patched to discourage reselling and burning it. I doubt anyone would confirm if they got the full payment or not for something similar.

by kuroguro

7/20/2026 at 12:46:37 PM

I work in the field and I just cannot believe anyone would pay that much for a Word Press exploit. People pay money for iOS or Android because there is valuable information stored on devices running those operating systems. There's absolutely nothing of value on any Word Press site. The only possible reason I can think of is for a watering hole attack, but that would require a second exploit that would be worth far more (and they aren't).

by bink

7/20/2026 at 1:26:34 PM

I currently work for a federal contractor including the DoD as their customer, using Wordpress as their main website. You would think there’s no sensitive information there, but some times all it takes is enough information about someone and their team to impersonate that person and gain access to an email thread, file sharing system or even an access card to a building. Never underestimate incompetence.

by tedggh

7/20/2026 at 3:48:26 PM

And never underestimate the competence of others.

by soulofmischief

7/20/2026 at 9:26:50 PM

lol, a big part of security is being smart enough to never challenge the bored…

by kulahan

7/20/2026 at 6:02:53 PM

Bulk reply to all the people replying.

bink is correct. The people who buy exploits are governments. There is very little interest in Wordpress or indeed any target that isn't a browser or a mobile. Browsers and mobiles are the only things that are perennially useful to an intelligence agency. Those two are reliable access vectors for the vast majority of things that interest government organisations.

by grugq

7/20/2026 at 8:14:07 PM

Are they only buying browser RCEs or are they also interested in RCEs deliverable via browser?

ex: Target hits website -> site delivers RCE for some software that is on the target's system

by strictnein

7/20/2026 at 7:56:38 PM

Aren’t WP exploits valuable for watering hole attacks?

by dcrazy

7/20/2026 at 8:09:21 PM

You don't need an RCE for that though. There's a lot of vulnerable plugins deployed everywhere.

by strictnein

7/20/2026 at 9:54:02 PM

Ok, but an RCE in WP Core still seems pretty dang valuable, especially if you want to hit non-commercial websites that are less likely to have as many plugins installed?

by dcrazy

7/20/2026 at 8:48:15 PM

You already owned the WordPress admin with your browser 0day, you don’t care if WordPress is secure or not.

by illliillll

7/20/2026 at 6:44:57 PM

> There is very little interest in Wordpress

I'd disagree here. Still 41% of all sites use Wordpress [1]... and that means a lot of targets, and a lot of ways to target them. Your good ole' deface/ransomware extortion scheme, leaking data supposed to be confidential (such as account lists), trusted spreaders for exploits, or the latest hit, bets on "prediction markets" that have some Wordpress site set as oracle. People are willing to screw around with airport weather stations to manipulate bets [2], it's not that much of a stretch to assume such incentives would also apply for website hackers.

[1] https://www.wpzoom.com/blog/wordpress-statistics/

[2] https://edition.cnn.com/2026/04/23/europe/france-weather-sen...

by mschuster91

7/20/2026 at 8:15:57 PM

Plenty of underground forums sell exploits for people to do stuff like that, but you're talking $200, not a theoretical $500k.

You also don't need an RCE for 99% of that.

by strictnein

7/21/2026 at 5:23:55 PM

This is an axiomatic response to an empirical argument.

by tptacek

7/20/2026 at 5:45:52 PM

Remember the Panama papers? That was a Wordpress hack.

by JSR_FDED

7/20/2026 at 2:06:29 PM

Surprising amount of gov use WP as a CMS on their websites. So it's not that far off.

by marysol5

7/20/2026 at 6:03:50 PM

> There's absolutely nothing of value on any Word Press site

This is just 100% an incorrect assumption. Even just an e-commerce site running Woo has troves of potentially valuable customer data. Not to mention whatever else might be on the server, or what that server is connected to...

by foco_tubi

7/20/2026 at 7:35:30 PM

>There's absolutely nothing of value on any Word Press site.

I would hope not, but I’d be surprised if that were true across the millions(?) of Wordpress sites?

by apercu

7/20/2026 at 3:19:41 PM

There’s a server running behind a Wordpress site. If you have RCE, you can run whatever arbitrary code you like there - mine crypto, run a botnet, all sorts of fun and profitable stuff. Hey, you can even make the site make the site’s users your unwitting hosts, too. You don’t go hack a Wordpress site, you go grab a few hundred thousand of them and do industrial scale crimes.

by madaxe_again

7/20/2026 at 12:24:37 PM

[flagged]

by tptacek

7/20/2026 at 2:37:23 PM

Is there anywhere currently buying that you can approach without a pre-existing relationship?

by intheitmines

7/20/2026 at 12:33:28 PM

Of course it is. It just no longer exists.

by StrauXX

7/20/2026 at 12:37:54 PM

Oh, you've done business with them then? Know someone who has?

by tptacek

7/20/2026 at 12:57:18 PM

Yes actually, I know someone who did business with them many years ago (before the advent of LLMs), although for a smaller sum than the advertised top payouts (the vulnerability they had was much less important).

Why post these random unsubstantiated claims on HN?

by cmeacham98

7/20/2026 at 3:31:38 PM

> Why post these random unsubstantiated claims on HN?

To show everyone the Gell-Mann amnesia effect in action.

When HN top karma poster and security professional posts something like this, doubles down, and can’t even be bothered to support it in any way (I’m open to learning and changing my opinion) it completely blurs the line going into social media influencer. Quantity over quality.

by close04

7/20/2026 at 11:27:29 PM

Yes, I have briefly done business with them as well. We also worked with Bekrar and Vupen briefly. Albeit, it was done through a broker. The second time around, we exited negotiations.

Just because they're exclusive about their clients doesn't mean they're not real. Their impact and effectiveness is a separate topic though. I don't think they're still actively operating or taking new clients, at least.

btw: "Oh, so you've done x?" What a snarky and confrontational way to ask someone something. Especially when it's asserting a well documented company and person is "not real".

by parl_match

7/21/2026 at 3:15:38 AM

[flagged]

by tptacek

7/21/2026 at 1:51:24 PM

Why are you constantly responding to people like this? What makes you think you’re above the rest of HN?

by ofjcihen

7/21/2026 at 4:07:19 PM

You apparently work in the field. Do you take these "price lists" seriously?

by tptacek

7/21/2026 at 4:15:06 PM

They can be and they can not be depending on what you’re selling.

But that’s besides the point. You straight up argued that one isn’t real in the most asinine way you could.

Even if you were right that would be ridiculous. The fact that you’re wrong and have multiple people telling you you are makes it even worse.

I’ve seen you replying in snide comments whenever someone disagrees with you before. Your status as…whatever you are doesn’t give you carte to treat randoms like they’re beneath you.

by ofjcihen

7/21/2026 at 5:03:57 PM

I'm noticing you didn't answer my question.

by tptacek

7/21/2026 at 5:26:36 PM

I did explicitly answer your question, yes.

This is how all of these sites work. You would not get 500k for every exploit obviously. You would get that (or more) for great exploits.

I’m noticing you haven’t addressed anything I mentioned at all. Is that just acceptance that it’s the truth or are you just having a bad day?

Edit: Actually, let me add that for a 0click exploit on mobile devices that leads to root level permissions you’re very likely sitting on millions of dollars.

by ofjcihen

7/21/2026 at 5:56:15 PM

This is 2 years old, but goes deep into the details of how the "0 click" market works, roughly what kind of money you'd be sitting on, and what it takes to actually get that money:

https://securitycryptographywhatever.com/2024/06/24/mdowd/

It sounds like you're telling me you believe you might get six figures for a "great" WordPress core RCE. I believe that's false, and I believe that for reasons that probably indicate our premises are much too far apart to hash this out here.

I have open contempt for online price list "brokers" like Zerodium. I do not have contempt for other commenters here. I think it's important that you understand the distinction before coming at me the way you've been in this thread. Disagreeing with me, rebutting or refuting me, sharply or ungenerously: totally fine. Your weird psychoanalysis of me: not fine.

by tptacek

7/21/2026 at 6:27:29 PM

Absolutely not.

> Did you get mid-high 5 figures for a serverside vulnerability? I hear the Russians are paying $300k for Postfix! But the UAE might pay $400k through Crowdfense. These numbers are definitely real. How could they not be? They're right there on a web page.<

> Oh, you've done business with them then? Know someone who has?<

You’re replies have been snide and rude and you trying to pivot and say “you were merely talking about the brokers” is further showing you don’t care and feel entitled to continue.

Other users are calling you out on this behavior here and on other threads as well to the point that the comment you made starting this has stayed flagged.

Deflecting from someone calling out this consistent behavior is frankly ridiculous in the face of the receipts, especially trying to villainize the people calling you out for it.

Also, not even the main point anymore, but you’ve intentionally mischaracterized every argument others have put forwards including in your most recent response. I was extremely explicit about what kind of exploit commands a high price and you’ve chosen to again twist the argument to your desired conclusion:

> It sounds like you're telling me you believe you might get six figures for a "great" WordPress core RCE<

My “psychoanalysis” was an attempt at giving you grace but you seem intent on proving that talking down to others and then trying to sidestep justified criticism are default behaviors that you’re entitled to.

by ofjcihen

7/21/2026 at 6:33:19 PM

[flagged]

by tptacek

7/21/2026 at 6:50:58 PM

[flagged]

by ofjcihen

7/20/2026 at 12:58:16 PM

I do, as a matter of fact.

by StrauXX

7/20/2026 at 4:13:49 PM

My lawyer says I can't answer that

by monster_truck

7/20/2026 at 12:56:56 PM

[dead]

by jnbcxdrun

7/20/2026 at 1:18:01 PM

Why would you reply with something completely unsubstantiated that anyone in security at that time worth their salt would be able to call you out on and then in subsequent comments call people liars for insisting it did, in fact, exist?

I’m just baffled.

by ofjcihen

7/20/2026 at 5:38:50 PM

The pricelist was a marketing stunt.

by dadrian

7/20/2026 at 12:34:46 PM

Why would anybody trust criminals to pay them over time?

by Hizonner

7/20/2026 at 1:00:59 PM

Because if they don't other people will hear they don't pay and won't sell them 0days

by idiotsecant

7/20/2026 at 1:25:10 PM

How long do you figure a criminal reputation typically needs/wants to last? I have always been skeptical of “black market credit ratings”. If you happen to build one up, it’s likely only in order to rip someone off at a higher price and cash in the value of it. It’s not like you’ll need that good rep for your retirement.

by nativeit

7/20/2026 at 1:53:28 PM

ShinyHunters has been "in business" since 2019 and it is their reputation that resulted in eg. Canvas paying their ransom this year. Without that reputation, it is unlikely a large-scale ransom would have been paid, because the reputation is what gives them credibility that paying the ransom will actually result in the promise being upheld.

by applfanboysbgon

7/20/2026 at 4:12:49 PM

What do you think the venn diagram looks like for people willing and able to find things like that prior to LLMs and also sell them to a broker, and are also stupid enough to flaunt a massive flashing "arrest me!!!" sign

Closest you're going to get is something like those kids in florida who just got wrapped for putting malware into steam games and draining peoples accounts. They were going to get caught anyways but it would have taken a lot longer to build a case against them if they weren't flaunting it on socials

by monster_truck

7/20/2026 at 6:44:29 PM

Is this comment pure speculation, or do you have knowledge (or anecdotal evidence) of a similar exploit being sold for $500k?

by nickff

7/20/2026 at 3:00:42 PM

"People paid $5,000 for a Macintosh computer when they were new. I found one at a yard sale for $25."

by trollbridge

7/21/2026 at 2:11:16 AM

Pre-1990s Macs (Mac Plus, SE, etc.) in good condition are actually worth a decent amount nowadays as collectors items. Not $5000, but quite a bit more than $25.

by sgerenser

7/20/2026 at 5:08:55 PM

this is the most accurate summary.

by grugq

7/20/2026 at 6:16:35 PM

I actually found a 1999 iMac set out for a special rubbish pick up day. The owner of the house was there so I chatted a bit, asked her if she minded if I took it.

It had last been booted on it, complete with working hard drive an; MacOS X 10.3. So $1.299 -> $0.

by trollbridge

7/20/2026 at 7:13:54 PM

That's just typical for computer hardware though. Depreciation is 3-5 years normally, after which it's considered worthless.

by SoftTalker

7/21/2026 at 12:32:02 AM

Ok, we've taken $500k out of the title above.

by dang

7/20/2026 at 1:22:36 PM

> modified like they are holy scripture

So never modified at all, even if plainly contradictory and/or ethically and morally compromised?

by nativeit

7/20/2026 at 2:12:01 PM

[flagged]

by stellamariesays

7/20/2026 at 12:31:09 PM

[dead]

by T3RMINATED

7/20/2026 at 12:02:37 PM

[flagged]

by functionmouse

7/20/2026 at 9:26:01 AM

https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa...

String concatenation SQL injection in the year 2026.

by progbits

7/20/2026 at 10:01:08 AM

Oh it's even worse: https://developer.wordpress.org/plugins/creating-tables-with...

>Rather than executing an SQL query directly, we’ll use the dbDelta function

>Note that the dbDelta function is rather picky, however. For instance:

>You must put each field on its own line in your SQL statement.

>You must have two spaces between the words PRIMARY KEY and the definition of your primary key.

>You must use the key word KEY rather than its synonym INDEX and you must include at least one KEY.

>KEY must be followed by a SINGLE SPACE then the key name then a space then open parenthesis with the field name then a closed parenthesis.

>You must not use any apostrophes or backticks around field names.

>Field types must be all lowercase.

>SQL keywords, like CREATE TABLE and UPDATE, must be uppercase.

>You must specify the length of all fields that accept a length parameter. int(11), for example.

by sunaookami

7/20/2026 at 3:42:10 PM

Sometimes when you write documentation for APIs you realize something is terribly designed. That should have happened here.

by duped

7/20/2026 at 3:23:22 PM

I like that you chose ten examples.

>> s/you must/thou shalt/g

by madaxe_again

7/20/2026 at 9:33:28 AM

The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.

by 9dev

7/20/2026 at 10:50:42 AM

It's just because they don't want to break anything in existing sites, sorta like how Microsoft doesn't generally want to break programs on Windows. So, changes are fairly incremental, and the quality is about what you'd expect from a piece of software that's decades old with no plan for what happens if it got this far.

But what do you do in that situation? If they change the structure too much, then either they make it impossible to upgrade an existing site, or potentially break a whole bunch of things said sites depend on (mostly themes and plugins). And that ease of upgrading is likely what stops a lot of people just migrating away to other solutions.

by CM30

7/20/2026 at 11:14:38 AM

Even just introducing emulation layers for the old parts and making the new parts opt-in would be better than just giving up and keep on going. Plugin authors can choose the new subsystem as they publish updates or new plugins and themes, and in return they get speed and security guarantees.

And since the WordPress foundation controls the extension marketplace, they can reliably determine which parts of the API surface are in use, or even invest a chunk of money every month to send AI-written patches to plugin maintainers to ease the transition.

There would be so many ways to improve the situation (to the benefit of WordPress maintainers, customers, and ecosystem vendors alike, mind you!), but alas, they are stuck to their ways and will not.

by 9dev

7/20/2026 at 6:41:40 PM

> And since the WordPress foundation controls the extension marketplace, they can reliably determine which parts of the API surface are in use, or even invest a chunk of money every month to send AI-written patches to plugin maintainers to ease the transition.

What WordPress foundation?

by ValentineC

7/20/2026 at 6:44:37 PM

The, uh, WordPress Foundation[0]?

[0]: https://wordpressfoundation.org

by 9dev

7/21/2026 at 4:52:34 PM

I don't know if things have changed since, but my understanding remains that Matt runs WordPress.org using his own servers and money, not the foundation's:

https://news.ycombinator.com/item?id=42689906

The foundation was, at some point in time when the drama was at its peak, mostly a feel-good non-profit initiative.

by ValentineC

7/20/2026 at 11:42:53 AM

they broke tons of stuff with Gutenberg/block editor and didn't seem to be bothered by backwards compat

by liveoneggs

7/20/2026 at 12:07:52 PM

Not only did they break classic WordPress stuff, but they also keep breaking Gutenberg APIs at a really frustrating rate.

It’s clear that the core WordPress developers have a very different idea of project stewardship than the Gutenberg devs do.

by stefanfisk

7/20/2026 at 5:19:16 PM

Blame Matt Mullenweg

by sunaookami

7/20/2026 at 3:53:14 PM

Fair enough. The way they added Gutenberg was a complete mess. Like yeah, the idea is a good one, and the editor can be pretty good if used correctly. But the way it was built was certainly not ideal, and was probably the worst of all worlds. Felt like someone saw SquareSpace and co, thought WordPress was falling behind and decided to push for those features to be added as quickly and inefficiently as possible.

by CM30

7/20/2026 at 7:39:43 PM

If the existing at-risk functionality is a security issue I feel like that’s a good time to throw the proverbial flag on the play and make it an issue. Letting consumers play host to malware and phishing portals is the worse move.

by antonymoose

7/20/2026 at 12:10:52 PM

This isn’t some problem that has developed over time. It was shit from day one.

by tonyedgecombe

7/20/2026 at 2:07:39 PM

Wordpress is a great web shell, shame it also comes with a blog

by marysol5

7/20/2026 at 3:17:29 PM

Is it? I did a project with WP a very long time ago and was kind of baffled. Like it's nice to have an good rich text editor, I got that part. But the absolute monstrosities people developed to extend WP, when they could have just used MySQL and PHP directly, astounded me. Like I couldn't figure out what WP was offering? It was just like a blog that you could painfully hack into something else if you wanted to. But even at that time there were already loads of great, batteries included PHP frameworks like Symfony or Cake. Why not just skip the painful part and code what you want directly?

Anyway, I probably shouldn't comment as maybe WP has progressed but it doesn't sound like it.

by jaredklewis

7/20/2026 at 4:00:44 PM

Honestly, the reasons could mostly be summed up as "we already used WordPress for the blog, we now need to add a shop onto the existing site, might as well extend the former rather than rebuild or maintain two systems".

Alternatively, folks that aren't particularly technical hacking together a solution that works 'well enough' for what they need, and agencies that only have the interest/capacity to use one platform deciding that each and every customer needs to use that platform.

If you're a skilled programmer WordPress is probably not a good solution for your issues, but if you're more of a designer or hobbyist that wants a somewhat hacky extendable blog system it's pretty easy to use.

by CM30

7/20/2026 at 6:55:48 PM

I suspect you missed the joke: A web shell is a script to execute arbitrary commands, i.e. Remote Code Execution.

by tredre3

7/21/2026 at 6:21:49 AM

oh haha. Yea, my brain somehow interpreted shell as framework.

But yes, I agree, WP is very useful for those times when you need to run a quick `sudo rm -rf /` command but can't get to a terminal.

by jaredklewis

7/20/2026 at 5:33:01 PM

You may be missing the point that the WP ecosystem is aimed at non-programmers.

by Exoristos

7/20/2026 at 10:22:24 AM

I'm convinced it's by design so that the community that build little businesses around wordpress still stay in the eco system. A client needs new functionality? That's be a week of work because god help anyone who wants to look into themselves.

WordPress is actively degrading the security and quality of the web I general. Has been for many many years.

by bilekas

7/20/2026 at 10:55:16 AM

The great irony is they still sport their "Code is Poetry" mantra on their website [0].

If code is poetry, Wordpress is a new genre of it, probably?

[0]: https://codex.wordpress.org/WordPress_Philosophy

by bayindirh

7/20/2026 at 1:43:11 PM

If code is poetry, WordPress was written by William McGonagall <https://en.wikipedia.org/wiki/William_McGonagall>.

by chrismorgan

7/20/2026 at 10:20:59 PM

Wow, he wrote like if you prompted obituaries to GPT-2.

by ahoka

7/20/2026 at 1:03:11 PM

They could just go a bit more honest and migrate to "Code is pasta". WP is also closer to a pizza slice than Michelin star fine dining experience.

by tiborsaas

7/20/2026 at 11:05:34 AM

They never said it was good poetry

by Yokolos

7/20/2026 at 10:58:55 AM

Ask an old English teacher whether "poetry" implies anything favorable about quality.

by bell-cot

7/20/2026 at 11:36:40 AM

Everything I've used from Automattic has felt that way. If you ever want to torture an engineer, just make them change the layout of WooCommerce checkout.

by evantbyrne

7/20/2026 at 9:53:04 AM

As a junior I am glad I happened to start working with PHP on version 7. I had some peeks at our legacy PHP5 stuff (all killed now thankfully) and it looked very different. I am sure it would suck to work with.

by asimovDev

7/20/2026 at 10:04:48 AM

php7 was such a great time period for PHP, honestly lots of great experimental projects around that time too (HHVM before that, etc).

by thejosh

7/20/2026 at 6:47:02 PM

PHP 8 is good too. Lots of syntactic sugar to make your life so, so much easier.

by mschuster91

7/20/2026 at 9:34:46 AM

it would help if they used strict types and modern standards but as you say the wordpress codebase is beyond dated and held together with duckt tape

by geek_at

7/20/2026 at 10:12:01 AM

I remember multiple projects giving up on rewriting it. Maybe a machine with endless patience could do it?

by khalic

7/20/2026 at 10:24:03 AM

I've done it multiple times but no one's gonna use my off the shelf blog when there's a bagilian WordPress plugins they wanna use. But with AI you kinda sorta should just build your own blog. Doctrine with slime framework. You can even throw a WordPress plugin at the LLM and ask it to implement the same thing.

by hparadiz

7/20/2026 at 12:52:41 PM

did you mean Slim, the PHP framework? When I google 'slime framework' i get some machine learning stuff

by asimovDev

7/20/2026 at 3:10:47 PM

Yea

by hparadiz

7/20/2026 at 11:54:56 AM

Yeah the consensus from everybody that spends some time on it seems to be: just don’t use it

by khalic

7/20/2026 at 2:50:30 PM

> But with AI you kinda sorta should just build your own blog

Please don't. There is absolutely no reason not to use the extremely simple and powerful combination of:

* a headless CMS / static website generated, of which there are a bunch so pick the one you like the most. My go-to is Hugo but it is somewhat complex

* a static hosting service with a generous free tier like CloudFlare Pages/Workers, Netlify, Firebase Hosting, etc.

Your blog costs nothing, has zero attack surface and zero maintenance.

by sofixa

7/20/2026 at 12:28:37 PM

tbf literally all my php hate comes directly from WP

by pwillia7

7/20/2026 at 10:38:35 AM

PHP is a proof that you don't need elegant or good technical solutions to be successful. You can literally pile up slop together and still be successful.

by mono442

7/20/2026 at 11:09:19 AM

Yeah; the common idea of dignity and self-respect is to replace the duct tape with proper engineering once you're successful though, instead of just taping ever more of it on top and pretending SQL injections aren't really a problem.

by 9dev

7/20/2026 at 12:22:14 PM

...but do they truly pretend SQL injections aren't really a problem, or do they in fact promote practices and provide pathways to reduce that risk?

by timbits98

7/20/2026 at 1:03:57 PM

What they do is put lipstick on a pig! There is no need to "reduce" the risk of SQL injections when you can use a safe API that eliminates the entire error class. This is a solved problem for the rest of the world!

by 9dev

7/20/2026 at 7:03:43 PM

PHP offers that safe API, though, and always has (prepared statements). The same one as all other languages.

PHP might seem worse than other languages due to a combination of factors:

- It's the most used one by far, even though few of us like to admit it.

- Old tutorials still come up during web searches, so "SELECT * FROM `table` WHERE id = $id" will still be written today.

by tredre3

7/20/2026 at 2:09:22 PM

I think PHP came right at the time that every man and his dog was a "web developer" and writing absolute unknowledgable stuff. And PHP allowed for it.

ASP had a bit of a barrier to entry because it required all the MS. Whereas PHP was everywhere.

by marysol5

7/20/2026 at 10:18:54 AM

It was like that in the old days too. Seriously who makes a postmeta table and goes "yea let's just throw everything in here. Indexes? Meh."

I cringe everytime.

by hparadiz

7/20/2026 at 2:42:10 PM

I don't think PHP is a beautiful language. If it was Laravel wouldn't need to rewrite every function from standard library. And, I see no reason to use it compared to Typescript.

by cute_boi

7/20/2026 at 7:01:18 PM

I never really understood these complaints about the standard library, that's not what makes a language really. Yes, it's ugly, yes, it carries 30 years of baggage, but it's PHP the language that allows you to interact with a much more convenient abstraction layer provided by Laravel.

PHP can run the same code fully dynamically typed or with very strict type annotations, depending on your requirements. It has runtime reflection APIs that are so cheap that you don't really have to think about using them. You can do OOP or FP with PHP, or even procedural HTML-interleaved-with-PHP if that's your thing. It has late static binding, so you can defer to child classes from their parent class. There are generators and fibres as first-class language constructs now. Property hooks are an extremely clear pattern, way better than in many other languages.

Generally, there have been tons of new syntax extensions over the years, and they all slot in gracefully. With PHP 8.6, we're going to get partial application for functions, which will make PHP 8.5's match expressions one of the most ergonomic implementations I have seen yet!

by 9dev

7/20/2026 at 2:48:19 PM

Ecosystem? The JS/TS ecosystem approach is to use as many libraries as possible for the sake of it, exposing you to a massive supply chain risk. PHP doesn't suffer from that because there are barely any libraries for it.

by sofixa

7/20/2026 at 7:06:41 PM

> PHP doesn't suffer from that because there are barely any libraries for it.

You don't need many libraries in a typical project, because PHP is batteries-included and if you use a framework it does all the rest for you, that is true. But there are still hundreds of thousands of packages with billions of installs:

https://packagist.org/statistics

by tredre3

7/20/2026 at 10:26:49 AM

[flagged]

by TacticalCoder

7/20/2026 at 11:07:37 AM

Let me convince you! :-)

There are match expressions and arrow functions:

  $slug = $title
      |> trim(...)
      |> (fn($str) => str_replace(' ', '-', $str))
      |> (fn($str) => str_replace('.', '', $str))
      |> strtolower(...);
There is meta-programming with annotations:

  final class PostsController
  {
      #[AccessControl(fn(Request $request, Post $post)
          => $request->user === $post->getAuthor()
      )]
      public function update(Request $request, Post $post): Response {
          // ...
      }
  }
Native (and optionally value-backed) enums:

  enum Status
  {
      case Draft;
      case Published;
      case Archived;
  }
Proper class property hooks, fully replacing getters and setters:

  class Data
  {
      public string $fullName {
          get => "{$this->firstName} {$this->lastName}";
          set(string $value) {
              [$first, $last] = explode(' ', $value);
              $this->firstName = $first;
              $this->lastName = $last;
          }
      }
  }
And tons of other features—among them asymmetric property visibility, fibres/green threads, DNF types, lazy object instantiation, an ever-improving yet fully opt-in static type system with runtime validation, a JIT compiler, an amazing package ecosystem and -manager, annotation-backed deprecation, and more.

by 9dev

7/20/2026 at 1:38:52 PM

> There is meta-programming with annotations:

There is, but your example is not valid. You can't use short function syntax in constant expressions, it has to be an explicit `static function`.

The reason for this, IIRC (I can't find the GitHub issue or PR atm) is that these functions aren't allowed to close over any variables, and with fn syntax doing so is implicit. Rather than erroring they've disallowed the use of arrow functions entirely.

by jorams

7/20/2026 at 6:04:54 PM

You’re right, of course. Still I think the point stands that PHP has very powerful runtime metaprogramming features that you can build amazing abstractions on top of.

by 9dev

7/20/2026 at 12:18:04 PM

The issue isn't that they haven't added a load of modern features; it's that they never fixed the old janky broken features.

by IshKebab

7/20/2026 at 2:10:38 PM

Reminds me that in the PHP5 days, there's a load of similar functions of which the parameters switch around...

by marysol5

7/20/2026 at 6:04:01 PM

Shame I forgot to add named arguments above, eliminating this problem too:

  array_map(callback: fn($i) => $i * 2, array: [10])

by 9dev

7/20/2026 at 2:44:35 PM

Looks like PHP is trying to act like Elixir. And all these are very new thing which we can't implement in wordpress because you have to care about backward compatibility.

by cute_boi

7/20/2026 at 6:52:07 PM

These "very new things" have, in part, been available for more than 6 years now. Not to speak of all the other PHP features WordPress chose to forgo, like PDO with prepared statements (which completely eliminates SQL injections), which came out 21 freakin' years ago.

There are many very successful and professional PHP projects with millions of users that seem to be able to migrate to newer PHP versions just fine.

Whatever the WordPress developers are claiming are the reasons for their irresponsible codebase and their inability to improve it is nobody's fault but their own.

by 9dev

7/20/2026 at 10:58:03 AM

> Nope.

Beauty is in the eye of the beholder, and I'll disagree kindly with you on that "Nope".

by bayindirh

7/20/2026 at 9:44:25 AM

What an awful fix. Does WordPress seriously still use basic string concatenation (edit: and sprintf) to build SQL queries?

by dinkelberg

7/20/2026 at 10:42:13 AM

To construct dynamic sql queries to have to string concatenate at least some parts, .

User data should of course be passed via prepared statements.

by Yokohiii

7/20/2026 at 3:14:30 PM

One usually uses "query builder" pattern for that.

Also, regarding placeholders, historically many DB and frameworks do not support passing lists for a value in a placeholder (like "WHERE id IN(?)") so users of such software fall back to string concatenation.

by codedokode

7/21/2026 at 3:24:06 AM

ORMs and query builders ARE concatenating strings.

by Yokohiii

7/21/2026 at 7:59:15 PM

But in a safe manner.

by codedokode

7/20/2026 at 11:37:00 AM

Not user code, no. Someone eventually has to, but virtually every ORM under the sun allows you to construct dynamic queries without having to concatenate strings yourself or resort to string interpolation.

by formerly_proven

7/20/2026 at 12:06:45 PM

Quick search shows this in Wordpress:

> WordPress database access abstraction class.

  class wpdb {}
So this is some sort of ORM provided.

  $results = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}options WHERE option_id = 1", OBJECT );
> Some of the methods in this class take an SQL statement as input. All untrusted values in an SQL statement must be escaped to prevent SQL injection attacks. Some methods will escape SQL for you; others will not. Check the documentation to be sure before you use any method in this class. For more on SQL escaping in WordPress, see the section entitled Protect Queries Against SQL Injection Attacks below.

It does not however prevent $wpdb users from NOT binding query parameters, which leads to this vulnerability.

by winstonwinston

7/20/2026 at 3:17:24 PM

It seems that wpdb doesn't support placeholders for comma-separated lists, like in "WHERE id IN (?)". So the developers have to fall back to string concatenation.

by codedokode

7/20/2026 at 9:53:23 AM

WordPress source code is a mess. They should re-write it from scratch using modern technologies, or even a framework like Laravel.

by reddalo

7/20/2026 at 10:56:06 AM

That could as well just be a complete new product then, right?

It would definitely be a breaking change and unmigratable.

by mewpmewp2

7/20/2026 at 11:08:08 AM

A few months back, Cloudflare used AI to make a Rust rewrite of WordPress, but I doubt that they would have found or corrected issues like this on the way? https://blog.cloudflare.com/emdash-wordpress/

by mapmeld

7/20/2026 at 12:53:35 PM

TypeScript, not Rust.

by mkl

7/20/2026 at 11:17:16 AM

Mullenweg will never allow WP to slip away from his control. "He wrote it" so you can't have it.

by pluc

7/20/2026 at 10:43:39 AM

Who is they? automaticc?

by sourcecodeplz

7/20/2026 at 12:21:14 PM

Impossible. WordPress has had the PHP-group even considering writing new PHP features in a separate 7.4 branche and release them specifically for WP.

by dncornholio

7/20/2026 at 2:20:48 PM

Ahhh very interesting! Thanks for pointing this out, I saw an attack against one of our sites this weekend using this exploit.

> data: {'requests': [{'method': 'POST', 'path': 'http://:'}, {'body': {'requests': [{'method': 'GET', 'path': 'http://:'}, {'method': 'GET', 'path': '/wp/v2/widgets?author_exclude=1%29+AND+1%3D0+UNION+ALL+SELECT+0%2C1%2C0x323...

by SpikedCola

7/20/2026 at 10:22:08 AM

>>Principal Software Engineer @ Bluehost. WordPress Core Committer. Baseball fan.

hmm yes, definitely. You are the principal.

by m00dy

7/20/2026 at 12:05:58 PM

I am so done with FOMO writing. Sure man, you found one with $25. With $25 plus your entire industry domain specific knowledge of where to look, of how to probe, of what else you may have accumulated and collected over the years of working within this industry. Let's stop with the gambling narrative and the illusion that we are all missing out.

by hmokiguess

7/20/2026 at 12:22:45 PM

I agree. This is so toxic! It feels like the Instagram of articles. "Look how my life is great" - yeah sure, you're posting only happy moments.

Not only $25 is not accounting the years of experience, but also all the failed attempts.

by w4yai

7/20/2026 at 5:29:28 PM

Should also note the math done on the token costs. $25 of subsidized tokens because he's on a subscription plan.

by paodealho

7/20/2026 at 2:30:34 PM

I can't agree with this more. May cooler, more compassionate minds prevail.

by recitedropper

7/20/2026 at 3:23:14 PM

And nobody would post "I did it for free!" if they had done it themselves, but somehow spending $25 on tokens changes how we're supposed to look at it

by deaton

7/20/2026 at 12:28:12 PM

[dead]

by assanineass

7/20/2026 at 9:08:08 AM

The surprising (and possibly untrue) thing is the high price of canned vulnerabilities. WordPress is known as the remote root shell with a blogging feature.

by ahartmetz

7/20/2026 at 10:42:34 AM

I still don't understand why, for a blog, a static page isn't enough - especially since most of the WordPress issues are "solved" by adding caching.

I do understand it from an user perspective (it's easier to tell the average user to drag and drop rather than committing to a GitHub repo and letting hugo build the website), but from a security standpoint WordPress is really just waiting for a vulnerability (either in the core or on the thousands of plugins) in order to unlock its RCE-as-a-service functionality.

by denysvitali

7/20/2026 at 12:22:59 PM

In many deployments, Wordpress started out as just a blog that is easy to edit right from the web browser, but then grew into way more. Most commonly, people end up retrofitting all kinds of e-commerce features onto it, and that's how you really get into the whole plugin mess. At that point, for better or worse, the Wordpress instance is serving important business needs that are not addressed by a static page.

by muvlon

7/20/2026 at 2:12:37 PM

It went from a blog, to an entire CMS. Which is bonkers

by marysol5

7/20/2026 at 10:54:00 AM

People like having a WYSIWYG editor, being able to update their posts in the browser, having comments and being able to use plugins. They're also not particularly skilled with the terminal/commands, and a lot of hosts provide a one-click install setup for scripts like WordPress.

by CM30

7/20/2026 at 11:00:20 AM

Like you said. It is a product for people who are not technical and don't code. A product that you would have to use git for, wouldn't be used by the 90 percent in the first place. And there are such products. There is a reason WordPress is the most popular platform. Most people are not technical.

And people like to be able to extend from Blogs to various other non static features which WordPress allows for.

by mewpmewp2

7/20/2026 at 12:52:41 PM

Its so funny… our wordpress started off as simple blogging thing but now is not only using 99% cpu but also no one knows how to edit/deal with all the plugins etc. Wordpress is the worst choice. Always

by thenthenthen

7/20/2026 at 11:19:01 AM

The non-profit I help with moved to Wordpress so people can edit the site without having to use git. (We have a lot more editors now)..

by acomjean

7/20/2026 at 12:05:27 PM

- Anyone can edit it

- Less training; org probably has someone who’s used Wordpress before. (Yes, training. You must deal with the reality of the typical user.)

- In the developing group or agency, anyone can work on the theme if you install a theme builder. An agency can put a cheaper content marketer or designer on it, rather than a developer.

by 1123581321

7/20/2026 at 12:30:03 PM

WPE tried to make Faust.js a thing so you could use WP CMS but generate a modern static site but I don't think it really took off much

by pwillia7

7/20/2026 at 9:13:41 AM

Propably untrue, the only way to know is to do threat intelligence, and inflitrate those telegram groups where these brokers operate, I doubt the writer of the article did that. Maybe he conflated any vulnerability with a 0-day one?

by gorszon

7/20/2026 at 10:12:20 AM

...or was just looking for a clickbait title.

Surely someone once offered a vulnerability for 500k somewhere, but that doesn't mean someone bought it.

by blauditore

7/20/2026 at 11:57:55 AM 

  WordPress is one of the most hardened targets of all time
that obsolete code did not change for decades. all the bugs have been discovered and patched

by slim

7/20/2026 at 9:25:42 AM

some statistics point to almost 50% of all websites on the internet running on Wordpress, $500k for an undisclosed 0day unauthenticated RCE doesn't seem so unrealistic to me

by lyu07282

7/20/2026 at 11:02:58 AM

I've got it at 38.32%. I'm looking at the 'front-door' of the web, active sites, no subdomains, from Crux user experience data.

Will be publishing a report on www.theweb.report soon - if you're interested.

That's a seed of about 13 million domains - pretty sure WordPress would be dominating the even longer tail.

( Also worth noting it's sooo easy to detect a site is WordPress, it screams it across every signal we gather, where-as some sites are just well made and have limited information leaks ).

by addedlovely

7/20/2026 at 9:24:39 AM

Interesting write-up and I do think LLM assisted/powered exploit disclosure is a real concern (I've been able to get models to create container breakouts from Linux LPEs relatively quickly).

One thing I'm surprised about is that GPT-5.6 didn't block that prompt due to guardrails. My experience is that GPT-5.5 and up does not like offensive security work (similar to Opus 4.7+/Fable).

I didn't notice it but I'd assume that the authors have some level of cyber approvals from OpenAI to relax the guardrails a bit.

by raesene9

7/20/2026 at 9:56:06 AM

This might help https://chatgpt.com/cyber ease the guardrails a bit.

by Santas

7/20/2026 at 10:48:27 AM

Thanks! I wonder if Claude has something similar?

by eru

7/20/2026 at 10:55:58 AM

They do: https://portal.anthropic.com/programs/cvp

by NiekvdMaas

7/20/2026 at 1:18:30 PM

Though this program does not apply to Fable. Which is why most security researchers have started flocking to Sol.

by danslo

7/20/2026 at 11:57:57 AM

I feel like I've seen plenty of non-AI, pre-2020 SAST tools catch SQLis like the one mentioned here, and if nothing else, then a code review ought to catch it. Is WordPress not using code reviews and/or SAST?

by lillesvin

7/20/2026 at 4:19:35 PM

They would not catch it, it requires combining multiple vulns.

by f311a

7/21/2026 at 7:29:20 AM

I just meant the SQLi (which is the basis of the chain), not the full chain.

by lillesvin

7/20/2026 at 5:03:22 PM

One of my websites was hacked with this, luckily not one with any users at all.

They did this:

- Two admin accounts in the database.

- plugin dir: wp-content/plugins/wp-core with remote command-execution web shell wp-core-[12 random chars].php

- firewall.php backdoor in mu-plugins dir with admin on GET ?sergei

- cache-seo-helper.php backdoor

- fixer.php which renames the wordpress version number to one which is patched.

I have decided to give up on Wordpress.

by secretslol

7/20/2026 at 10:30:25 AM

The author lost me at the last bit where they started using weird names for the posts. Why would you make one ID O and the other ID 0? Why single letters and not EMBED_01? Why seemingly random letters instead of ABCDEF? Does OCPDST stand for something?

by lexicality

7/20/2026 at 10:46:30 AM

They are placeholders, their meanings are spelled out in the post:

    O: publish/oembed_cache, empty content, stale timestamp with parent C
    C: future/customize_changeset, changeset JSON with parent C
    P: draft/page, with parent D
    D: parse/request with itself as its parent
    S: publish/post, for providing embed data
    T: publish/post, containing the outer embed

by moebrowne

7/20/2026 at 6:00:55 PM

That doesn't actually answer any of my questions though. Why is `S` the placeholder for "post"? T for T'outer?

by lexicality

7/20/2026 at 6:29:04 PM

I'd expect the amount of money paid for exploits to go down then. It's inefficient to pay >$25 for an exploit that took $25 to make.

by barbazoo

7/20/2026 at 9:32:57 AM

> Is GPT5.6 Sol Superhuman?

This is not a simple y/n question. Computers have been superhuman at playing chess for decades now. Reading this article, I guess they are superhuman at understanding code now as well.

by ifdefdebug

7/20/2026 at 9:52:45 AM

> Computers have been superhuman at playing chess for decades now.

And at doing arithmetic for even longer /i

by chrisjj

7/20/2026 at 9:48:13 AM

This assumes those who'd pay $500k don't have the skill to use GTP5.6 for the same purpose themselves?

by cromka

7/20/2026 at 12:34:22 PM

Then why didn't we see the same writeup earlier? If you look through the writeup, you still need the skills to go through what the LLM gives you and actually create a valid proof of concept.

I've been using LLMs to find security vulnerabilities and there is no way I can just submit what I found and call it a day (many try).

by elmer2

7/20/2026 at 10:06:38 AM

You read articles regularly about how X authority is provided cloud LLM history and uses it as evidence to prosecute a defendant.

Yet you think professional criminals are too stupid to launder their activities through an unscrupulous yet legal intermediary?

by cheschire

7/20/2026 at 10:09:19 AM

People who make the money are not necessarily the people who can write the best code.

Elon Musk didn't write code for a rocket, he hired people who could.

by khurs

7/21/2026 at 1:23:05 AM

I might be missing something, so perhaps someone can explain: Why are the steps in the middle of the exploit chain necessary? The writeup describes getting a SQL injection, then going from there to cache poisoning to exploiting various logic bugs, to eventually creating an admin account (and WordPress grants RCE to admin accounts by design). But if you have a SQL injection, why can't you use that to just create an admin account directly, by inserting it into the users table?

by ameliaquining

7/21/2026 at 5:45:14 PM

[dead]

by mariushh

7/20/2026 at 11:24:30 AM

wordpress is so shitty - though it runs the majority of the web.

people think PHP is shitty cz of Wordpress.

at a certain point in time - people need to move to better ecosystems painful as that may be.

by dzonga

7/20/2026 at 4:23:40 PM

Historically, a lot vulnerabilities in PHP projects were because of PHP itself. Things like register_globals, remote includes/reads using functions that supposed to read local data and so on.

by f311a

7/20/2026 at 11:14:11 AM

That was an incredible writeup! Chapeau to the author - thanks for taking the time to do a writeup.

When Anthropic claimed Mythos chained 4 or 5 bugs to achieve sandbox escape and found bugs in core software, it sounded like bs. But here we are 2 months later seeing what they meant.

Cybersecurity was always a hard sell; security flaws were invisible - by contrast a fence with a hole is visible to everyone - anyone can ignore the locked gate and walk through the fence hole. With cybersecurity a hole in the fence may go unnoticed for years, maybe forever.

LLMs level the field. We will all benefit from more secure systems, a few people will get a lot of egg on their faces, and it will end the malpractice of underinvesting in software security to get a product out the door.

by cadamsdotcom

7/20/2026 at 11:36:01 AM

| We will all benefit from more secure systems

the people that can afford it, sure.

by alienbaby

7/20/2026 at 12:05:56 PM

Can some people not afford open source software?

by s3p

7/20/2026 at 9:07:24 AM

This one is both awesome and scary. We are living in a black mirror episode, where one well-crafted LLM prompt can get you $500k or the ability to hack into 500M websites :)

by vavkamil

7/20/2026 at 9:29:42 AM

The market will quickly adjust to the point where spending $50 on tokens will on average give you a vulnerability valued at $50. Maybe $100 to account for your edge in having a better prompt and the risk of prison time you take in selling the exploit

In fact that may well be true today. OP didn't try to sell it to discover the true price the market is willing to pay. And we all know that "somebody paid $$$ for something similar in the past" is no guarantee that somebody else is willing to pay any significant sum for your thing today. If it was, startups would be a lot easier

by wongarsu

7/20/2026 at 9:29:46 AM

I don't think OP got $500k , it's only clickbait in the title.

by hoppp

7/20/2026 at 9:35:58 AM

One LLM prompt can't get you $500K. Why would someone spend $500k instead of just prompting themselves?

by Philip-J-Fry

7/20/2026 at 9:41:47 AM

Because they don't know you can

by inigyou

7/20/2026 at 3:44:39 PM

I think anyone willing to pay $500k is well aware that LLMs can be used to find vulnerabilities.

by muldvarp

7/20/2026 at 9:17:56 AM

Don't get all starry-eyed, the people owning those sites also have access to LLMs, so both the hacks and paydays are rare.

by cbg0

7/20/2026 at 9:15:09 AM

So they spent the $25. But the real question here is did they get the $500K?

by aussieguy1234

7/20/2026 at 6:09:21 PM

Unquestionably they did not.

Their listed pricing was up to $50k.

https://cyber-peace.org/wp-content/uploads/2017/09/ZERODIUM-...

And that was before LLMs could produce these at volume.

The demand (dollars) does not go up commensurately with the supply. So today maybe $500 or a few thousand. Maybe not even that.

by az226

7/20/2026 at 12:35:52 PM

Probably not. The Wordpress Bug Bounty program pays very little. Exploit brokers will pay 500K, but we wouldn't be seeing it here if it was sold.

by elmer2

7/20/2026 at 10:25:08 AM

The cost of business nowadays? At what point does it become apparent that in today's world software needs continuous pen testing and scanning? If you don't your attackers will.

by _superposition_

7/20/2026 at 11:38:57 AM

| in today's world software needs continuous pen testing and scanning

points to a bigger problem perhaps; software design, construction and distribution is fundamentally flawed.

by alienbaby

7/20/2026 at 5:08:13 PM

Seems like exploit brokers can just buy a codex license and put the 500k towards finding all bugs in all software for the price of one bug

by throwitaway222

7/20/2026 at 12:07:31 PM

Does Sol allow this kind of research by default or is this a "look at me I'm on the cyber research allowlist" post?

by r1ch

7/20/2026 at 9:48:47 AM

What was the harness used? And yeah surprised about such prompts not being downright blocked, even with the cybersafety verification"

by mixtureoftakes

7/20/2026 at 1:10:33 PM

The "pro's buy out a company that has a massive add-on install base with the most non-technical users.

by _joel

7/20/2026 at 9:07:31 AM

Nice balance between practicality and ambition. Curious how it holds up with real-world scale.

by preetham_rangu

7/20/2026 at 9:45:59 AM

RCE — Remote code execution

by jorisw

7/20/2026 at 4:10:52 PM

Thanks

by sashank_1509

7/20/2026 at 9:39:30 AM

I like the idea of not crediting the person who posted the bug but to the LLM that found it. People who find exploits using LLMs should never get a reward or credit.

by CodeCompost

7/20/2026 at 9:40:24 AM

So people coding with LLMs shouldn't get paid then, right?

by pelagicAustral

7/20/2026 at 9:42:38 AM

That is in fact the end goal of CEOs pushing LLM use yes. Not possible right now, but if it were they would absolutely take that option.

by grey-area

7/20/2026 at 9:49:09 AM

[citation needed]

by jorisw

7/20/2026 at 11:08:50 AM

Does "companies will cut unnecessary costs" need a citation?

by bspammer

7/20/2026 at 4:36:35 PM

Do you think the CEO of your company hired you and pays a lot of money for you because they like you?

by muldvarp

7/20/2026 at 3:46:06 PM

Do you assume that five years from now you'll get paid for coding with LLMs?

by muldvarp

7/20/2026 at 9:53:18 AM

Correct.

by bakugo

7/20/2026 at 9:53:55 AM

They should get paid by the LMM only.

by chrisjj

7/20/2026 at 10:18:57 AM

It baffles me how this can be said without concern for first order consequences.

by Levitz

7/20/2026 at 9:43:47 AM

I agree! We should go all the way though and credit the authors of the data the LLM was trained on. People who just run LLMs training scripts should never get a reward or credit.

by nubg

7/20/2026 at 9:59:40 AM

I take credit given all my infosec-related reddit posts they used for training.

by defmacr0

7/20/2026 at 12:33:56 PM

How do you find exploits without risking someone seeing your attempt and reporting you as a hacker? do you register first somewhere?

by perarneng

7/20/2026 at 12:41:21 PM

You can run Wordpress locally in your own sandbox to test these vulnerabilities, you don’t have to break any laws.

by kamranjon

7/20/2026 at 11:02:52 AM

On another note - who needs WordPress in the age of Astro and LLMs?

I mean, it's not a taunt, but a serious question - do people keep WordPress because it used to be the easiest solution to set up years ago, or are there still clear use cases where one can argue it's the best solution?

by stared

7/20/2026 at 11:45:27 AM

I have not yet seen an alternative for Wordpress + woocommerce for a simple e-commerce site that is not more expensive. I am open for alternatives tho if anyone knows any

by justanotherunit

7/20/2026 at 11:15:00 AM

does Astro do WYSWIYG?

by crummy

7/20/2026 at 6:35:18 PM

I wonder if there could be a crowdfunding to harden Wordpress with the leading models, or some who might have access to something like a Mythos level.

by j45

7/20/2026 at 9:10:02 AM

Presumably they don't pay $500k anymore...

by IshKebab

7/20/2026 at 9:20:15 AM

Just like that, the 0-day black market is experiencing a mini black Monday.

by rvz

7/20/2026 at 12:37:11 PM

[flagged]

by supportm

7/20/2026 at 1:37:21 PM

[dead]

by koko443

7/20/2026 at 9:27:14 AM

[flagged]

by throw8394498383

7/20/2026 at 9:33:44 AM

Just do the KYC and it happily shits out 0days

by illliillll

7/20/2026 at 9:17:58 AM

Can RCEs like this still be sold to exploit brokers like Zerodium? If so, how? Asking for a friend

by yellow_lead

7/20/2026 at 2:38:40 PM

lol. Simple case of if you have to ask, you probably shouldn't.

by titularcomment