mariushh

I spent some time this weekend reproducing the recently disclosed XSS2Shell: WordPress login-page reflected XSS (CVE-2026-64638). If you didn’t get a chance to read about it, here is the summary: Crazy simple XSS where the root cause is two sanitizers that disagree about what counts as an HTML tag:

<b>test</b> gets stripped, while < b>test< /b> passes through the first sanitizer and is normalized into a valid <b> element by the second.

That gives you an HTML injection, but you can’t turn it into XSS because the second sanitizer has an allowlist and only allows specific HTML tags and attributes. The rest of the chain uses JavaScript already loaded on the login page, DOM clobbering, and a JSONP response to reach script execution in the login page. It’s a creative chain, although much simpler than the WP2Shell chain from two weeks ago.

IMO the “2Shell” part from the title is a bit of a stretch. The original write-up continues after triggering the XSS to show how you can get a RCE (basically by targeting an admin account to open your XSS which uploads a shell as a plugin). I agree this can be abused at scale given how widely used WP is, but it’s a phishing-shaped precondition rather than “send one request, get a shell” as we’ve seen in WP2Shell. It’s a cool bug anyway.

I turned my reproduction into a guided lab for anyone who wants to work through the chain rather than only read the write-up.

Feedback on the lab or the technical explanation is very welcome.

That's a fair point, and I'd actually agree with the premise. I work in an environment where the scale makes it impossible to fully understand the full picture, so it's true no single engineer holds the full territory.

But I think the distinction isn't about completeness of knowledge. It's about the feedback loop. Engineers hold partial mental models, but those models are constantly being corrected by reality. You get paged at 3am, you see traffic behave in ways the docs don't describe, you debug something and discover the system doesn't work the way anyone thought it did. Tribal knowledge is actually a good example of this. It exists precisely because someone experienced something that was never captured anywhere. LLMs can't acquire that because they don't experience the system IMO.

Hi HN.

I spent some time thinking through what "building software" actually means in the age of AI, what's genuinely changing, what isn't, and why the discourse keeps getting stuck on the wrong question. The article summarizes my thoughts.

AI making programming accessible to more people is a genuine good. The apps are real, they run, and the excitement is deserved. But everyone is asking "will AI replace software engineers?" when the more interesting question is hiding in plain sight: what happens when there is more software than people who know how to operationalize it?

I tried to think this through honestly rather than just react to the hype. Curious what people here think.