Hahah PHP is shit, good thing use nodebros and pythonchads are safe with our cool modern languages... ACK!
*usfuck me and my minor typo
>>110147627does it affect nginx?
Webslop apocalypse
>>110147627>AI helps quickly discover vulnerabilities omg this is terrible! If only they could dedicated like 5% of their computer to just fixing and patching things
>>110147627>>110147670blame vibecoding incompetence.
>>110147861>it's... le heckin vibecoding!lol. programmers have spent decades saying their code barely works and everyone would be horrified to learn that the world runs on broken code from the 80s/90s and excel.
>another hyped-up vuln that's impractical impossible to exploit outside a very tightly controlled lab environment
>>110147627I'd never heard of HTTP before today
>>110147627This is a vulnerability in Brotli, which has been inseparably embedded in every web browser for the past ten years. This means you can instantly get silently rooted on any device you use just by visiting the wrong website. You don't even need to visit a malicious site for it to happen to you. You could visit a typical news website that loads a thousand shady ad networks and telemetry partners, and all it takes is for just ONE of them to send a malicious Brotli payload to your browser, and then you are FUCKED FOR LIFE as it encrypts all your data and infiltrates all your shameful secrets and blackmails you with crypto ransomware. Clients can also send malicious Brotli payloads to servers to instantly gain root access on those servers, and then alter the servers to spread Brotli payloads to any clients that load webpages from those servers, zigzagging the payloads back and forth at an exponential rate until the entire world has been infected. This is actually the end of everything. The only possible way to prevent this is if a benevolent worm exploits this to spread itself for the sole purpose of disabling Brotli in everything
>>110148331>all it takes is for just ONE of them to send a malicious Brotli payload to your browser, and then you are FUCKED FOR LIFEthen why does the PoC show it having to retry dozens, sometimes hundreds of times before popping a shell
So AI is bad at writing secure code.But at the same time it's good at finding vulnerabilities.
>>110148365I've been having AI write the code, then recursively asking it to find bugs and exploits while resetting the context between passes. I'd like to think it's doing a good job.
And you know what the funniest and most ironic part is? Vibegods who built the backend in Rust, without even looking at the source code, are more secure than tradcoders who wrote the PHP by hand.TOTAL VIBEGOD VICTORY (once again).
>>110148448more like TOTAL RETARD FAILthe rust backend calls the brotli decoder, which is written in C
>>110148465don't tell slopcoders that, they may realize that they have no clue how their own systems work
>>110148365Incorrect—SI is incredible at writing secure code, and incredible at finding vulnerabilities. SI is simply better than any human ever was—or ever could be.
>10.0 CVE for the Pillow dependency for Python>Go to update it>Unsigned yt-dlp with a Singapore IP requests firewall permissionsThe end times are upon us.
>>110147627Don't use HTTP
>>110147861It's a complete VIBEAPOCALYPSE Shitty code AND vibecoded slop is getting buttfucked by AI agents. It's like the wild west of agents now since people realized they can just release thousands of agents bruteforcing their ways into any hole.
>>110147627PHP was proven bullshit. The "vuln" was known 10 years prior and is impossible to exploit. Even the labs swearing by the 2026 CVEs said it's only possible in lab conditions because it requires deliberately breaking the config of the webserver, and guessing the memory map of the server you hit, and guessing the set of all software used. Let me guess, this one is also bullshit.
>>110147915That's the thing: vibeslop is even worse than that. "It barely works and it's all duck tape and chewing gum" looks like genius god-code compared to the vibeslop.
>>110148331wtf is brotli
Wake me up when it affects a real language.
>>110148787A shitty format that was called broli (obviously a dragon ball reference) but the sjw's unironically had a melty because it has "bro" in the name, so he changed it to "brotli" (which still has bro in the name but the sjw's were satisfied by having their way on this).
>>110148289I saw an article today saying 'Zuckerberg got rich making Facebook with PHP, but the author of PHP never saw one cent of it'.
