66
There isn't an easy exploit for this PHP vulnerability (eliastaylor.com)
submitted 15 hours ago* by to c/selfhosted@lemmy.world
19 comments fedilink hide all child comments
 

I came across the link via https://mastodon.social/@CuratedHackerNews/117481600704689796

Last time I touched php it was ~20 years ago and maybe for a month. Could someone with actual php understanding weigh in?

Somehow, somewhere between the lines, my understanding was that there have been observances of the vuln being used in the wild before the 14 UTC. And that wasn't from reading news sites

you are viewing a single comment's thread
view the rest of the comments
[–] 25 points 9 hours ago (3 children)

This is dangerous misinformation. Both PHP bugs are real and together they are exploitable without the server having some other rare problem.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 2 hours ago (1 child)

    So where are the real world exploits? Wouldn't we hear of lots of barely maintained php servers being cracked open everywhere?

    This is increasingly a story similar to the boy that cried wolf... next time people will not take such CVEs serious anymore.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 hour ago

    It's too soon. Only people who are on top of things would have already noticed, and then even after people notice they're probably going to want to do investigations and get PR people and lawyers involved before making any public announcement. We're more likely to hear the consequences from dark web forums first.

  • permalink
  • fedilink
  • source
  • parent