Seems like everyone here has an exploit but they're all busy washing their hair, or thinking of the children, or making huge amounts selling their exploit on the darknet instead.
Given there are public patches and explanations of the issue, isn't it a little late to try to keep this under wraps?
Over a day or two we'll see whether people have an exploit - if more than a few people do, someone will claim this $1k soon. Out of curiosity, what do you plan to do with your exploit that you're holding back?
Unfortunately I left all my easy PHP exploits together with my pre-2023 writing that Pangram flags as 100% AI in Canada with my long-distance girlfriend.
Oh, you left your other pants with her?
Yeah I had it all on a CASIO JD-6000 in the jeans pocket.
My man
I have discoverd a truly marvelous RCE which this margin is too narrow to contain.
lmao
It's done, anyone still talking about this is in the business of monetizing trending keywords (or crime), not in the business of cyberdefense.
Anyone that's thinking about defending basically stopped thinking professionally about this on Thursday midday when the PHP update was released and the patch was applied. Maybe on Friday we learned that there were no confirmed exploits or even theoretical exploits, so we discarded the marginal possibility of our servers being exploited stealthily and having a dormant attacker in our perimeter (it was a buffer overflow attack after all, very hard to execute).
So it's out of mind for us, it's almost saturday, the only reason to think about this anymore is to grift or to think about the social contagion angle. To many of us it was a random tuesday, business as usual, but some people are still thinking this was a somehow special event? My guess is that it was the fact that there was an embargo break and it caused some issues in that 12 hour period between the leak and the patch, but it was a nothingburger, now it just needs to die, at least after it makes its round through the content-creators whose 9 to 5 is looking at trend charts and monetizing views.
It’s Sunday already! (or almost Sunday, depending on your timezone)
The only reason Php2shell wasn't as bad as it could've been was because basically no malicious actors had exploits that were useful in time.
Whoever broke the embargo is a moron and it could have resulted in much more damage than was done.
I think there's still going to be a massive long tail of sites that will never be protected or upgraded, unfortunately that's the reality. So no amount of delay will help them, and most active sites will have patched by now after 5 days.
There are already many people claiming they have an exploit, some in this thread, I think this is a useful measure of just how easy it is - thankfully it doesn't look too easy as it's still up at time of writing, though surely someone will manage it soon.
If it does get taken quickly I think that's useful information on just how serious this is.
If it doesn't, that's also useful info though not hard proof there is no exploit. It does mean that there is no exploit in the hands of script kiddies with chatgpt or similar.
I too have various websites that dont get hacked.
I'm not sure what this page proves except that not all set-ups are in danger. Especially if the site does nothing and has a nginx in front that caps all requests to 1mb.
There are, afaict, at least half a dozen choices a PHP server could have made that mitigates all (known) exploits. Putting some bitcoins behind one of them isn't exactly proof of anything, except as a PR stunt to convince people PHP is not a pile of tightly coupled hot-c garbage.
---
Other projects that get CVEs talk about what went wrong and how to improve. So far i've only seen PHP people defensive and telling each other that ok because other projects also get CVEs.
Hey, you're leaving out that nginx's default is to cap at 1m, btw.
The Dutch government websites that went down have multiple endpoints to upload files that do not have a 1MiB cap.
But the Dutch government websites do generally (I hope) have users, which is one of the ways the "I need to hit the same php worker, uninterrupted, for about 10 to 30 seconds while absolutely no other traffic hits the site AND I can isolate the one worker from the pool" approach to exploiting fails.
Luck is not a security boundary, they should patch their servers, everyone should. It's not a good thing to have shitty memory management on your server.
However, is this really that exploitable in real world conditions? (no)
"There does not exists" and "I've not heard off" are different things. This is motivated reasoning on your part to tell the story that this isn't a big deal.
Most variants require a few requests to infer some settings, and then they can spam their arming-stage, and then their exploit stage. Granted, its not quite as easy as that, but hitting _a_ worker twice on a server once is not all that lucky.
Also, 03:00 at night is not a busy time.
So according to you they could have just imposed an upload cap instead and been safe? If all the cybersecurity experts had given useful advice like that earlier in the week people could have been safer and less panicked.
That is quite literally what I said yes: https://news.ycombinator.com/item?id=50224916#50228891
> I think there's still going to be a massive long tail of sites that will never be protected or upgraded,
Ok? But that's super common, and there's thousands of ways to exploit unmaintained systems, nothing special about this.
From a technical level as well, this is not an easy bug to exploit, it's CVSS Attack Complexity:High, it requires a lot of per-target work, it's definitely not copy.fail level
Shared host Wordpress sites basically run in unprotected untrusted mode since WP has so many RCEs already and they can be in any random plugin someone adds at any time. So even if there's an RCE a lot of these sites just shrug at the attack. You would need to figure out how to chain it for something useful.
But wait, weren't we all told that exploits where already happening all over the place and thats why the embargo was broken?
Cloudflare even claimed they mitigated a bunch of it.
Which is true here? There was widespread usage of this exploit prior to the patch and just after, or that there were "basically no malicious actors had exploits"?
There's a lot of smoke being blown by companies with a financial stake in coming off as "security-minded" or something.
There's apparently _some_ exploit usage in the wild before the embargo breaking, but it very much looks like they didn't even achieve RCE, or if they did it was not widespread at all. It doesn't mean it wasn't possible by a group more sophisticated, it just didn't happen thankfully.
After the embargo was broken, RCEs were still not widespread, especially not before a huge number of sites patched themselves.
So, no, the narrative that skids with agents were busting down doors as soon as the embargo was broken is not accurate. But breaking the embargo before a patch was ready only hurt the situation for defenders.