| ▲ | Gigachad 7 hours ago |
| This one stands out because it's trivially exploited over the internet on the default configuration for all PHP versions. Most vulnerabilities require being able to run malicious code on the machine or using some rare configuration. If the rumors going around are true this will be the worst computer security incident in history. |
|
| ▲ | afdbcreid 6 hours ago | parent | next [-] |
| It's not "trivially exploitable". Two or three years ago, this would be a critical issue but require quite some expertise to exploit and exploits definitely wouldn't spread like that. LLMs are shaking the entire security industry. |
| |
| ▲ | Tadpole9181 5 hours ago | parent | next [-] | | It's trivially exploitable because it requires no special set up, no special credentials, no privileged access of any kind. If you can call a PHP server and you have the exploit script, you can execute arbitrary code as their `www-data` user. Usually, attacks are at least conditional and require something that weakens security guarantees. | | | |
| ▲ | altmanaltman 5 hours ago | parent | prev [-] | | Yes but that means it is trivially exploitable today since anyone can get access to a LLM and where to point it towards. 2-3 years ago, things were different, that is also correct but that doesn't mean things stay frozen in time. | | |
|
|
| ▲ | dgrunwald 4 hours ago | parent | prev | next [-] |
| Are you forgetting about log4shell? log4shell was easier to exploit.
It also come with an initial patch that turned out to be incomplete, so everyone had to urgently patch every java web app twice! |
| |
| ▲ | Freak_NL 3 hours ago | parent [-] | | Log4Shell required that the attacker be able to generate a log message containing specific parameters. It was a severe exploit, but not one that worked in every Java application with the affected Log4j versions. Attackers had to find calls that logged user submitted text or query paths first. So the list of prerequisites was larger: had to be using Log4j and had to have logging of user generated text. Still a very large attack surface, but not nearly as ubiquitous as this one. |
|
|
| ▲ | eithed 3 hours ago | parent | prev [-] |
| Heartbleed |
