> I'm not sure how "RCE on every PHP server, from anywhere on the internet, no other requirements" could possibly be underblown by anyone
It could be overblown if it's not true. The amount of time it took for anyone to claim the Bitcoin from the supposedly-vulnerable PHP site convinced a lot of people that the vulnerability was not as bad as claimed.
Why would someone send their exploit chain to a random for a mediocre 'bug bounty'. The bounty was later claimed by people who just did It for fun after work for fun with a LLM of their choice quickly.
There were prominent people saying stuff like "this bug is so bad, every PHP server is vulnerable to any script kiddie with an LLM; simultaneously, my exploit is so valuable and secret that I don't want to tell you what it is; also although I could totally steal this bitcoin, I choose not to, but I totally could if I wanted to".
Which is pretty indistinguishable from people just lying about how bad it is? How are you meant to tell the difference? How can it both be true that the server is vulnerable to any script kiddie with an LLM but your exploit is too valuable to share?
And the fact that the server turned out to be not exploitable just proves that the people claiming to be able to exploit it in fact were lying.
wasn't it setup in an unexploitable configuration (not actually serving a php page IIRC?) for most of the time, and then got popped within like 2 hours once fixed?
The point is, under normal configurations when you're serving the PHP server correctly with table-stakes best practices the server is not exploitable
This was not a scary vuln at all.
Under normal configurations the server is highly exploitable.
It's a horrible vuln and I don't understand what's with all the flat infosec society coming out of the woodwork.
The challenge server had vibe coded infra that made it hard or impossible to hack, but it was a configuration that can't be used in production and no one uses ( it was deployed as a PHP static content server instead of a dynamic site generator )
>I don't understand what's with all the flat infosec society coming out of the woodwork.
Ha, while most of these are probably humans that are just being driven mad by AI, I wonder how long before we get AI driven botnets that try to under play any security vulns to give them more time to take over and collect assets for themselves?
Are you sure this isn’t already happening?
Normal configuration of a PHP server is to not run any PHP code and serve a static html file?
Where is all the evidence of exploits if most of the webs PHP servers were vulnerable?
This is a seperate chained exploit itself, seemingly executed by a nation stae. There are thousands of exploits infiltrating web servers around the world daily, and they arent php2shell.
You only care about this because it falls into a weird viral narrative about "AI saftey".
There's nothing separate about this.
Chained just means they used php2shell to run a local privilege escalation.
Was the exploit not dependent on a kernel exploit that was disclosed and patched in may, or am I just hallucinating?
Depends which part: php2shell does what it says on the tin: lets you run arbitrary commands as www-data.
If you want more than that you need to chain an LPE. Which are plenty these days sadly.
Which best practices did you use to prevent exploitability?
And would you stake your bitcoin on it?
I had a similar take, but I was wrong.
How were you wrong? Out of 15k targets scanned they arrived at 25 servers total.