As one of those comments I dispute your characterization of it as the reported vulnerability being fake, very few people were saying that. The main thing being called fake was the narrative that with AI it was trivial to exploit the vulnerability.

It has not escaped me that the successful exploit did in fact just say “codex, exploit this” and got it.

I had assumed the rash of commenters saying “lol I am not revealing my AI’s exploit for a measly 500 bucks” were saying that because their AI attempt failed. Now I know they didn’t even try!

I mentioned this a couple times there but the unintended consequences of that challenge are wild. 2 hours after it the server was fixed there was a successful exploit but because it was originally misconfigured a huge number of people walk away thinking the vulnerability was not serious. At the least we now know a good way to convince large swarths of technical folks to not take new vulns seriously! Which seems not good

The main kickback was against the hype and it was "so easy for AI" and would take "15 minutes to compromise everything".

Either way, this was not true.

I was trying to steal those, but when I setup my local version, I things a little different: php-fpm and glibc because I thought this how everyone would run php with nginx. PHP-FPM recycled OOM workers, so there were no corrupted state to exploit and then when I switched to "php -s", glibc with ASLR made it not very practical to exploit.

Changed my lab to use the same alpine + php = tada working exploit.

To be fair, he hasn't had time to do the write up yet. When he does I fully expect it to hit the front page.

Two things can be true:

1) A motivated human eager for $500 and internet cred can exploit a vuln (perhaps using AI tooling to help)

2) The vuln is not easily exploitable at scale by driveby bots.