Hacker News Reader

Maybe the person that reported the exploit to Zerodium already cashed out in mid 2017 and was angry that the exploit hasn't been fixed yet. Therefore, he decided to make it very obvious and force php to react.

View on HN

I believe the exploit itself was introduced with the commit in question, it wasn't there before.

As has been pointed out elsewhere, the exploit is the ability to inject code into the PHP Git repository. Not this RCE.

The other exploit, the one that allowed the commit to be injected.

Reply on news.ycombinator.com