Darren Pinder

Tagging @ethicalhack3r @OliverSild @photomatt and @perezbox so you can loop in @GoDaddy if you still have contacts there. And looping in @gdb because he and @eastdakota are appearing together. Guys we haven't seen a single hacked WP site from #php2shell and we're (@wordfence is) protecting over 5 million PHP/WP sites. You know the deal. If it's exploitable, we all see site cleanings. No one in cybersecurity wants to minimize a vulnerability in case it does blow up. We're seeing reports from @Cloudflare and @eastdakota of attack attempts. We're seeing attack attempts in our telemetry. But we're not seeing a single compromised site. No one wants to say that it's not exploitable against vanilla PHP because it may turn out to be. I think we all know CVSS scores are imperfect. And the messaging here is off the charts. This has gone mainstream, but no one is talking about the fact that no one is seeing hacks. It's easy to take a bow and claim industry success, "go team cyber" and all that. But you know if these things are a legit risk you'll see compromised sites. Especially in the PHP/WP space where there are a lot of individual boxes out there with owners on vacation or MIA. And nothing. Not one. So I think the conversation that needs to happen is something like this: We're going to find scary vulnerabilities with the amazing capabilities that @OpenAI and @AnthropicAI are bringing online, but we need to calibrate the messaging to take into account how exploitable and scriptable each vuln is, or we risk alert fatigue and blowing credibility which we'll badly need when an exploitable scriptable vulnerability shows up.