# First-Principles Source Reading Finds Bugs Patch-Diffing Hides ## Claim Reasoning from how code is structured surfaces classes of bug that pattern-matching against known fixes cannot, because a genuinely novel bug does not resemble the catalogued one. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds where the vulnerability is a structural or logic flaw — a desync, a confused deputy, a state-machine gap — rather than a signature-detectable pattern (a known-bad function call, a missing escape). - Breaks down for bugs that are signature-detectable, where pattern-matching is faster and sufficient; first-principles reading isn't a universal replacement for diffing, only the tool that catches what diffing structurally can't see. - This is the operating principle behind the agent-code-analysis guardrails in `~/.claude/CLAUDE.md`: remove the answer key so the reasoner works from structure, not from a known patch to pattern-match against. ## Evidence The wp2shell pre-auth RCE chain (Icex0's PoC) traces back to a REST batch handler building two parallel arrays indexed by the same offset, where one path's parse failure lets the arrays drift out of step. The desync looks nothing like classic injection until the arrays are traced — exactly what patch-diffing, anchored on a specific known instance, is prone to miss at the class level. This is also the literal worked example CLAUDE.md's agent-code-analysis guardrails are drawn from (Kues' published wp2shell prompt). > [!quote] > A sub-request whose path fails `wp_parse_url()` is appended to `$validation` but not to `$matches`, so the arrays fall out of step and a sub-request is dispatched under a different sub-request's handler. ## Links - [[3. Resources/Permanent Notes/Batch Endpoint Validate-Execute Desync Is an Exploitable Seam]] — because evidence-for; this is the specific mechanism-level bug that first-principles reading, not patch-diffing, would have to find - [[3. Resources/Permanent Notes/Validation That Inspects Steps Cannot See Composition]] — because extends; both name a class of bug that lives in the composition of steps rather than in any single step, which is exactly what diffing against one known fix tends to miss - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — because applies-in; a methodological principle for how the audit work behind that MOC should actually be done ## Tests / falsifiers - Take a corpus of disclosed WordPress core/plugin vulnerabilities and check whether patch-diffing against the fix commit alone would have found the bug pre-disclosure — if it would, the bug was signature-detectable and this claim doesn't distinguish the two methods for that case. - Track whether a first-principles read of `serve_batch_request_v1()` (or an equivalent function) actually catches the class of desync bug before a public PoC exists, not just in retrospective analysis of an already-known chain. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Readwise/Articles/Wp2shell (CVE-2026-63030 & CVE-2026-60137) — Full Pre-Auth WordPress RCE Chain]] — Icex0's technical writeup and PoC for the pre-auth RCE chain this claim generalizes from.