446
PHP was just the beginning: Node.js unveils dangerous flaws threatening millions of sites (cybernews.com)
submitted 1 week ago by to c/technology@lemmy.world
92 comments fedilink hide all child comments
 

Node.js has just released fixes for 10 security vulnerabilities that could put node-powered applications at risk and is urging everyone to update their systems.

you are viewing a single comment's thread
view the rest of the comments
[–] 22 points 6 days ago (7 children)

While the world reels from websites being taken down before critical PHP patches were released

Is it just me or did anyone else not even notice outside of articles lol... It was all resolved by the time I got off work.

  • permalink
  • fedilink
  • source
  • hideshow 7 child comments
    •
  • [–] 20 points 6 days ago (4 children)

    It’s not resolved until everyone installs the patch. And there in lies the problem.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 5 points 6 days ago* (3 children)

    An important point yes and I do understand that, but the major players like Steam were updated and done before I knew it. I have no doubt this could come back to bite companies/people lagging behind over the next few years, but the impact to me from websites being taken down was 0, which was my point.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 9 points 6 days ago (2 children)

    The companies with well-resourced dev teams would have been able to deal with it. But for every one of those there's 50 companies with no dev team who are sending frantic emails to the guy who quit 3 years ago asking if he's available for some urgent work. And another 50 that are not sending any emails because they're oblivious and will get pwned in a few months.

    A lot of PHP apps are old, unmaintained or run by people with no idea. That's kinda it's niche.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 6 days ago*

    Not entirely accurate. I happen to be my company's 1 man IT army, and I got it all plugged within 4 hours (php2shell, CA certificates, which I only had to rotate, etc). It was bad, but the noise was even worse. If IT departments are proactive and do their jobs, the actual problems should be little to none.

    Then I did the same in my proxmox, everything is just fine.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 5 days ago

    The only site I knew was affected was the next cloud homepage which I checked for updates if they already had a patched version for there docker containers. So I thought it quite funny that the site I visited to see if they had fixed it was also affected.

  • permalink
  • fedilink
  • source
  • parent