Remix.run Logo
▲ dawnerd 7 hours ago

I tried it on a personal site, was able to dump the entire database. Immediately shut all my sites down. This is bad.

▲burnJS 6 hours ago | parent | next [-]

How can I try this to see if I should shut things down myself. I run a 6 figure stealth and have a day job for fintech in 9 figures all php so kinda worried

▲dawnerd 6 hours ago | parent | next [-]

Used this as a base: https://jackalsyn.com/posts/php-up-2026.html

But created my own based on it since it feels sketchy running someone else's exploit poc ya know. Ran it first in a vm before running it against a production site.

▲cinpol 2 hours ago | parent | next [-]

I ran the PoC on my dev environment, the PoC is not complete and does not work.

▲burnJS 6 hours ago | parent | prev | next [-]

I tried this more simplistic variant https://pastebin.com/kggc4q1T which supposedly would crash php but it was rejected by my CSRF middleware...

▲afdbcreid 6 hours ago | parent | next [-]

If you maintain a 9 figures business, I would recommend to not rely on that and shut it down or at least do more.

▲system2 3 hours ago | parent [-]

A 9-figure business with PHP is mind-boggling.

▲normie3000 3 hours ago | parent [-]

Wait til you hear about The Facebook.

▲dan15 2 hours ago | parent [-]

Facebook hasn't used PHP for a very long time. It's been using Hack for over 12 years, which was initially based off PHP but it's deviated quite significantly now. It's now nearly entirely statically-typed, and has a bunch of features that PHP doesn't have. IO is fully asynchronous using async/await syntax (like C# or JavaScript), functions can be marked as pure, and a bunch of other things useful in large codebases.

It still uses the same request model as PHP, since that's genuinely useful for web requests. It's easier to avoid memory leaks if each request is entirely self-contained and there's no global state persisted between requests (other than APC and opcode caches)

▲dvdkon an hour ago | parent | prev | next [-]

I tried it too in a clean Debian Trixie container and got no crash.

▲sznio 5 hours ago | parent | prev | next [-]

then you need to use a correct csrf token. it doesn't protect against this, anyone can get a valid csrf token, every visitor gets one.

▲brazzy 3 hours ago | parent | prev [-]

This link gets me a shitton of extremely intrusiv ads, some of which look like malware (auto-downloading an "OperaSetup.exe"). Is pastebin already compromised?

▲tikotus 2 hours ago | parent [-]

I got this same earlier, but now it seems to be working. Perhaps just an oddly timed bug with some ads that has nothing to do with the incident?

▲td4 an hour ago | parent [-]

Pastebin is just sketchy for a while now

it now serves ads that instantly start those downloads its been like that for a couple of weeks

▲sdfgsdfgsdsdfgs 5 hours ago | parent | prev | next [-]

On which OS and Server did you run the exploit against?

▲ 5 hours ago | parent | prev [-]
[deleted]
▲stackghost 6 hours ago | parent | prev | next [-]

You make 9 figures at a fintech? Are you hiring?

▲burnJS 6 hours ago | parent [-]

Fintech makes 9 figures. I make 6 there and 6 at my stealth :-)

▲00deadbeef 5 hours ago | parent [-]

What is a "stealth"? A secret side project?

▲rokkamokka 4 hours ago | parent [-]

Basically taking two full-time jobs and lying about it

▲voidUpdate 31 minutes ago | parent [-]

God I wish I had the energy to have 2 fulltime jobs. I barely have enough for 1

▲theteapot 6 hours ago | parent | prev [-]

You use PHP at a fintech?

▲burnJS 6 hours ago | parent [-]

One of many languages. It has its role.

▲lolakutty 6 hours ago | parent [-]

>It has its role...

Of being a hole...

▲febed 3 hours ago | parent | prev | next [-]

Does the exploit need a framework like laravel or can it work with just plain php

▲rossriley 3 hours ago | parent [-]

No, this happens sometime in the request parsing process, any exposed php URL would be vulnerable.

▲winternett 4 hours ago | parent | prev [-]

Meh, I'll just roll PROD back to our 4.7 image, then head down to the pub for a pint until this all blows over... Only 3 years of data will be missing... No biggie! LOL :P