|
| ▲ | lol768 8 hours ago | parent | next [-] |
| > as of my comment, this is not endorsed by PHP Are you speaking officially here? There are various mitigations suggested online, including completely blocking multipart requests at LB level. Is the combination of both effective? |
| |
| ▲ | lynndotpy 8 hours ago | parent | next [-] | | I am not affiliated with PHP in any way or sense, I am saying this as someone who is able to see PHP's announcements, and there was no patch or mitigation announced by PHP. I don't think pulling mitigations from random users online during a developing situation is a good idea. I think shutting down ones PHP services for the time being is a very good idea if that's an option. | |
| ▲ | 1over137 7 hours ago | parent | prev [-] | | "LB"? | | |
|
|
| ▲ | LoganDark 9 hours ago | parent | prev | next [-] |
| I wouldn't skip updating, but is there anything else we can do, other than simply shutting down the web server until the fix is available? |
| |
| ▲ | lynndotpy 9 hours ago | parent | next [-] | | I do not have details about any mitigation. There are rumors that people have independently come across php2shell exploits. I shut down my servers five hours ago. This might have seemed premature at the time. I think the best course of advice for most people is to shut down their servers as soon as they possibly can. | | |
| ▲ | qingcharles 7 hours ago | parent [-] | | I applied the mitigation to all my servers when it was released, but now I've stopped all the httpds. A few hours of overnight downtime, vs potentially trying to restore everything from backups tomorrow. Everyone should weigh it up. |
| |
| ▲ | xena 9 hours ago | parent | prev [-] | | You could disconnect the web server from the internet! |
|
|
| ▲ | ThePowerOfFuet 7 hours ago | parent | prev [-] |
| The PoC says so. |
