Yeah, AI seems like a good shift in "narrative making." It's easy to ask AI "give me an efficient way to "confirm or deny this narrative" and have something like this go viral. This is good because it makes narratives more truthful

What point is an anonymous online post proving? Can anyone verify that the private key actually exists? Or which version of PHP the site is running? Or if it is running PHP at all?

right: either it’s so hard to exploit that $1,000 isn’t enough to risk “giving away” your exploit chain or actual exploitation of this bug is impractical, either way the CVEpocalypse is overblown

The value proposition isn't there.

If you reframe the perspective from 'free $500 sitting on a server' to 'requires actively utilizing an unreleased 0 day exploit on a server that will certainly be able to track exactly what was done, for a payout of... $500?'

That's pennies for something like this.

Add two zeros and it might get nabbed.

Edit: others have pointed out it's not really a 0-day anymore, they're right, so it's likely more a matter of time.

It seems like the server got DDoS’d before anyone got to the bitcoin.

> There is a lot of cynicism in this thread but the fact this is still open and hour later ends the narrative in my view.

Clearly people aren't cynical enough.

I find it strange no one in this thread has even considered the possibility that the private key of the wallet isn't on the machine.

OP gets their working exploit neatly logged (or even multiple approaches), keeps the money, strengthens the illusion the exploit isn't that bad, and gets a free $500 on top from someone who added to the wallet.

no it doesn't . absence of evidence is not evidence of absence

You can see the commenters arguing with me about ASLR in the old thread. Half the commenters here, including quite a few "thought leaders" (not gonna name names or ad hominems but everybody knows who they are), insist that there are ways to implement this exploit at scale without having to do rowhammer-style spam brute forcing. I am still waiting. There's a lot of FUD and hearsay in the tech circles grapevine but very little evidence of actual working exploits against a modern Linux server outside of "attempts".

https://news.ycombinator.com/item?id=50188948

I am still waiting for them to put their money where their mouth is.

Except, it’s the top entry in HN right now. It could have gone down to the hug 20 minutes after it was posted, so nobody much has had a chance to have a go at it.