If they're so confident this isn't exploitable this person should stand up a very basic nginx running php-fpm server running in an exploitable version of PHP and invite people to exploit it.
If they're so confident this isn't exploitable this person should stand up a very basic nginx running php-fpm server running in an exploitable version of PHP and invite people to exploit it.
I ain't paid to find exploits in PHP, but I will be fired if our shit gets hacked. So I'm taking down the servers until there's a patch.
I totally agree. We can sit here and posture all day, maybe it might justify our paychecks. Exploit it and show me why it’s fucked. Otherwise it’s just words
As Linus says: talk is cheap; show me the code
Bonus points put cryptocurrency private key on their server as bounty.