United KingdomJaydip Modhwadia achieved remote code execution in roughly 3 hours.
His script bypasses address space layout randomisation, the barrier experts thought would block real-world attacks.
The challenge site served a PHP endpoint, and his single Python script needs 20 web requests at most.
Hudson Rock’s Alon Gal says it was target-specific and does not prove attacks can run at scale.
VulnCheck’s Spencer McIntyre says attackers are still finding new ways to exploit the flaws.
How each outlet framed it
- TheRegister.com
- traces the exploit's hook requirement: the static-HTML site only became exploitable after a PHP file was added around 1300 UTC
Sources: TheRegister.com