Time is the whole point though. Everyone was terrified and shutting their websites down because they believed the exploit would be running wild on the internet in between it hitting git and them being able to update the server.
If it takes a week to come up with a working exploit code, the critical services have time to update.
Time is part of the point, but it is not the whole point. The whole point involves the fact that this impacts two decades worth of PHP versions. Even if it took months to exploit, there is going to be a long, long tail of breaches against ill-maintained legacy sites.
Yes, but that's not really relevant to the controversy over the embargo.
Neither the OP nor any comment in this chain of replies is about the embargo?
The controversy over the embargo is why the post was written and why we're talking about this at all.
Huh, I thought we were talking about this because it's a massive security breach offering approximately unconditional RCE against half of the servers on the open web.
The specific reason for the current degree of consternation, to the point where many websites went down preemptively which didn't happen even with Log4Shell, is that for about half a day there were multiple alleged proofs-of-concept circulating on Twitter while the PHP Foundation refused to release the patch. If that hadn't been the case, we'd still be having a conversation, but a different one.
Suppose hypothetically there was no disclosure period at all. Suppose that at the time the PHP team made the announcement that there was an unmitigable unconditional RCE against ~every version of PHP with advice to take servers offline, they had just been made aware of it themselves, and simply did not have a patch ready yet. The pre-emptive taking of servers offline until a patch was available, the OP blog post that was written, and this comment thread would all still apply the same. Nothing in this thread was in any way related to the embargo period. It is extremely weird that you came into a thread irrelevant to the embargo and told me my comment was irrelevant to the embargo, and then have stuck to your guns arguing this incessantly. The embargo and the severe vulnerability are related. They are not the same thing, and much of the conversation would in fact be exactly the same regardless of the embargo.
There's no need for an embargo before the patch is available, because the core team can just not tell anyone. It's only once there is a patch that the decision has to be made whether to embargo it.
Time is not the whole point. How are people in this thread this clueless?
Risk is the whole point. The websites going down first were government / healthcare.
Do you expect these websites to take the risk? Risks that you now feel is justified because hindsight seemed to have collapsed the possibility-space?
We can talk about this again next year; if still nobody has demonstrated a working consistent attack that _could_ have pwnd my gov and medical records, then we can reflect on the severity score and the response.
But just because there isn't a working PoC on GitHub doesn't mean there isn't one and things aren't been actively exploited.
If you are a bad actor you probably don't share your PoC around as it means less boxes to hit.
You can never rule out the possibility that someone interested in attacking you has a non-public exploit, but it's dramatically less likely if there aren't already working exploits circulating all over the internet.
It was true before great LLMs era
I don't think that's very true. Certainly, modern LLMs make it much easier to discover a vulnerability given only limited clues—but if it's easy to find that way, then probably someone will do that and post it for clout. So if no one has, then it probably isn't.
With AI i think it's safe to assume it would only take hours after you give it what/where to look
AI makes developing this exploit faster though
That "if" is load bearing and increasingly flat-out false.
Crowdstrike's average "breakout times", the time gap between a first successful infiltration and maximal exploitation, has gone from days or hours prior to 2024 to minutes or seconds now.