| ▲ | bwoebi 7 hours ago |
| For everyone wondering why the patch is not out yet: There are a handful people responsible for doing a release. They are still asleep. To be honest, I am also shocked, that the exploit was published that quickly, after the leaked video (which was the reason, why the announcement happened in the first place, at that specific time). We expected a bit more time, even with LLMs... |
|
| ▲ | summner 3 hours ago | parent | next [-] |
| today only a rumour of a bug is enough to find and replicate it quickly. anything that narrows the searchspace |
|
| ▲ | jacquesm 41 minutes ago | parent | prev | next [-] |
| > We expected a bit more time, even with LLMs... That's horribly naive with an installed base this size and if you are that geographically dependent then I would hope to read how this will be dealt with going forward. |
|
| ▲ | joshuat an hour ago | parent | prev | next [-] |
| Good for them to be able to sleep the night before this chaos was meant to erupt, earnestly. |
|
| ▲ | jwitthuhn 6 hours ago | parent | prev | next [-] |
| Hopefully the industry will learn something about how withholding fixes to known vulnerabilities is, in fact, bad policy. |
| |
| ▲ | my-huge-pony 3 hours ago | parent | next [-] | | How? Biggest organisations and shared hosting providers had a chance to patch and protect their users. Everyone else will learn about the vulnerability the second patch comes out (this is also fixable with a configuration chance, so nobody needs to wait for their distro). This was the right approach and it worked. | | |
| ▲ | jwitthuhn 2 hours ago | parent | next [-] | | They didn't release the patch out of fear that someone would quickly use the patch to develop an exploit, meaning an exploit is available shortly after the patch. What they have achieved by delaying the patch is that exploits are now available publicly before a patch. Surely this is the worse outcome. | |
| ▲ | ameliaquining 2 hours ago | parent | prev [-] | | The problem is that, since proofs-of-concept have leaked but the patch isn't available, bad guys can attack any site whose operators aren't part of the club, and the only thing the operators can really do to prevent that is to take the site offline. (PHP core team has denied that the configuration change fixes the problem.) I would call this a significantly worse outcome than everyone finding out about the vulnerability at the same time, since in that case operators can take timely action if they get the news quickly enough. |
| |
| ▲ | heresie-dabord 4 hours ago | parent | prev [-] | | > the industry will learn something This is something of a fallacy. "The Industry" cannot learn. But laws and regulations can require better security. As in the history of seatbelts in vehicles, tech tool stacks are insecure by design and no one is ever really held accountable... until the cost is deemed too high. It's evident that we have not reached that limit yet. |
|
|
| ▲ | ftfyyyyyy 4 hours ago | parent | prev | next [-] |
| https://images.chainguard.dev/directory/image/php
looks like patched builds for 8.5-8.2 are available here |
| |
| ▲ | dlor 4 hours ago | parent [-] | | We've been working with the team on the coordinated disclosure, but I made the call to get these out early when exploits hit in the wild. The vulnerability and patch are both very complex, and the maintainers did an incredible job on this one. We tested the patch extensively and it's holding up well. We've made these images free and will keep them that way. | | |
| ▲ | thenaderman 2 hours ago | parent | next [-] | | What an incredible irresponsible move essentially 0-daying everyone who was working toward coordinated disclosure to ensure everyone had images or distro packages to update to. | | |
| ▲ | tarsinge 3 minutes ago | parent [-] | | An exploit is already in the wild. What seems irresponsible is not adapting to a new reality. |
| |
| ▲ | aarondf 4 hours ago | parent | prev [-] | | Sorry the last images I see are from 13 hours ago. Are those for the 2 RCE ones? |
|
|
|
| ▲ | Shank 2 hours ago | parent | prev | next [-] |
| Honestly, kindarails2shell resulted in a responsible disclosure coordination followed by the decision to release early since it was reversed too quickly. Even just a hint of a 0-day is enough to cause people to look for it and exploit it with LLMs. |
|
| ▲ | thenaderman 2 hours ago | parent | prev | next [-] |
| This is nonsense, disappointed to see that publicly from a core dev. Yes, some people are asleep, but the decision was made to wait, to ensure the patch is only made available when users are actually able to install the update and we're giving distros the time to build PHP packages. |
|
| ▲ | baggy_trough 7 hours ago | parent | prev [-] |
| [flagged] |
| |
| ▲ | 27183 7 hours ago | parent | next [-] | | lmfao what... If the police woke me up to fix anything the only thing they'd get out of me is "lawyer". And I wouldn't put a single iota of effort into fixing that thing until the entire matter with the police was resolved. If you want someone's attention on something, especially something nuanced and intricate like a software bug, that's absolutely not how you get it. | | |
| ▲ | zeeZ 7 hours ago | parent | next [-] | | In March this year, German police set out to warn admins on a weekend. German article: https://www.heise.de/news/WTF-Polizei-rueckte-Samstagnacht-w... | | |
| ▲ | CookieCrisp 5 hours ago | parent [-] | | Personally, I’d be glad to be woken up for something like this. I wouldn’t want it to be a demand, but a demand wouldn’t be needed anyway |
| |
| ▲ | jyunwai 5 hours ago | parent | prev | next [-] | | A civilian government official outside of law enforcement could be a safer pick. A CISA representative (or any non-US country's equivalent department/ministry of cybersecurity) could achieve the same outcome, or even better, as they'd have more technical background to explain what's going on. | |
| ▲ | illiac786 6 hours ago | parent | prev | next [-] | | Depends on the tone of the police, but if they’re just waking you up and make sure you take a call from your boss, then are on their way, why not. Beats panicked boss banging on the door. If there’s one thing I cannot handle while doing something critical in production, it’s panicked boss in the same room as me. | | |
| ▲ | ipaddr 5 hours ago | parent [-] | | How are the policemen waking you up if not pounding on your door or breaking it down? Or if they found a key under a mat and are beside your bed shaking you awake. In those cases I'd rather the boss pounding at the door at least I could call the police and have them removed. | | |
| |
| ▲ | redox99 7 hours ago | parent | prev | next [-] | | It could be just a friendly phone call to wake you up and read the news. Doesn't mean they are forcing you to do anything. | | |
| ▲ | Georgelemental 6 hours ago | parent [-] | | There is no such thing as a "friendly phone call" at the middle of the night from a police officer you don't know. | | |
| ▲ | OrderlyTiamat 6 hours ago | parent [-] | | If it's just a phone call, why involve the police at all? But if that doesn't work, and it's critical that someone is woken up and no one is near, I could see the police as a reasonable option. I agree with GP that my first instinct would be "lawyer", but I'm imagining the police at the door saying something like "hey we're here to inform you there's an urgent xyz, we'll now be on our way" and leaving. At that point that's the police matter resolved, no? |
|
| |
| ▲ | Dylan16807 5 hours ago | parent | prev [-] | | What do you mean "resolved"? Once they wake you up they're done. |
| |
| ▲ | aaron695 6 hours ago | parent | prev [-] | | [dead] |
|
