[meowface]

The agent is discussing source code he inspected likely after acquiring an image of the server. The vulnerability you described isn't how they got their information.

I'm reading through it now, but it's still not 100% clarified how they originally determined the true IP and provider of the server. There are a myriad of different ways, though.

[crb002]

Kind of shocking though if NSA didn't use a PHP vulnerability. PHP has more leaks than Chelsea Manning.

[ye]

Care to name 5?

[dlgeek]

http://www.cvedetails.com/vulnerability-list/vendor_id-74/pr...

[ye]

Actually, all of the severe bugs there are fixed and/or no longer apply.

Linking to ancient bugs that were fixed a long time ago is pointless, every popular piece of server software would have bugs.

So, care to name five?

[gtirloni]

Once bitten, twice shy.

[code_duck]

Sure, do you have $50,000?