4 ms·

Maybe the person that reported the exploit to Zerodium already cashed out in mid 2017 and was angry that the exploit hasn't been fixed yet. Therefore, he decide

Maybe the person that reported the exploit to Zerodium already cashed out in mid 2017 and was angry that the exploit hasn't been fixed yet. Therefore, he decided to make it very obvious and force php to react.

Angius 6y ago
I believe the exploit itself was introduced with the commit in question, it wasn't there before.
- kenmacd 6y ago
  The other exploit, the one that allowed the commit to be injected.
- toxik 6y ago
  As has been pointed out elsewhere, the exploit is the ability to inject code into the PHP Git repository. Not this RCE.