[newguy33]

Yea, that's what's confusing. some of these are like lower level slop but some are like genuine criticals.

Floci, libssh2, c-ares, FFmpeg, and the PHP one are all LEGIT./

The Ghidra one for example, not so much. I cant help but wonder if this was halfway completed research folder and they just published it as is

[smsm42]

PHP one is at best a moderate-level bug in SOAP client which I don't see any realistic way to exploit (the whole convoluted setup in the POC assumes PHP execution access, which begs the question why bother if you already can execute arbitrary code?) - does not look like "genuine critical" at all.

[newguy33]

Critical is an overstatement but it userland PHP execution does not equate to native process control. There are many situations where an attacker may have constrained PHP execution, gadget execution, template or plugin execution, deserialization reachability, or a sandboxed context, but not arbitrary native code execution or arbitrary memory write. Definitely impactful

[smsm42]

Security-wise, there's no such thing as constrained PHP execution, at least with the standard PHP engine. The surface is too wide. You still have OS constraints of the user and capabilities and such, but beyond that if you can run PHP code, you can run anything.

[andai]

I wonder if LLMs can tell the difference. Maybe it's like back in the day when you had to add "+good -bad" because otherwise it wouldn't know you wanted it to be good.