| ▲ | dawnerd a day ago |
| Used this as a base: https://jackalsyn.com/posts/php-up-2026.html But created my own based on it since it feels sketchy running someone else's exploit poc ya know. Ran it first in a vm before running it against a production site. |
|
| ▲ | dwedge a day ago | parent | next [-] |
| They've retracted RCE capabilities from that site, said they made a mistake and it's a crash bug. So what base did you use? |
|
| ▲ | cinpol a day ago | parent | prev | next [-] |
| I ran the PoC on my dev environment, the PoC is not complete and does not work. |
|
| ▲ | burnJS a day ago | parent | prev | next [-] |
| I tried this more simplistic variant https://pastebin.com/kggc4q1T which supposedly would crash php but it was rejected by my CSRF middleware... |
| |
| ▲ | afdbcreid a day ago | parent | next [-] | | If you maintain a 9 figures business, I would recommend to not rely on that and shut it down or at least do more. | | |
| ▲ | system2 a day ago | parent [-] | | A 9-figure business with PHP is mind-boggling. | | |
| ▲ | normie3000 a day ago | parent | next [-] | | Wait til you hear about The Facebook. | | |
| ▲ | dan15 a day ago | parent [-] | | Facebook hasn't used PHP for a very long time. It's been using Hack for over 12 years, which was initially based off PHP but it's deviated quite significantly now. It's now nearly entirely statically-typed, and has a bunch of features that PHP doesn't have. IO is fully asynchronous using async/await syntax (like C# or JavaScript), functions can be marked as pure, and a bunch of other things useful in large codebases. It still uses the same request model as PHP, since that's genuinely useful for web requests. It's easier to avoid memory leaks if each request is entirely self-contained and there's no global state persisted between requests (other than APC and opcode caches) |
| |
| ▲ | rob a day ago | parent | prev | next [-] | | How? This guy makes over $100k/mo from his PHP sites: https://x.com/levelsio | |
| ▲ | doublerabbit a day ago | parent | prev [-] | | Wait until you hear that banks use Perl. | | |
| ▲ | system2 18 hours ago | parent [-] | | Do you remember the last time Perl had a flaw like this that took every bank down? I don't. | | |
| ▲ | rurban 17 hours ago | parent [-] | | bugzilla still relies on perl's non-existing tainting of hash keys. I fixed that about 10 years ago, but perl5 never did. |
|
|
|
| |
| ▲ | sznio a day ago | parent | prev | next [-] | | then you need to use a correct csrf token. it doesn't protect against this, anyone can get a valid csrf token, every visitor gets one. | |
| ▲ | dvdkon a day ago | parent | prev | next [-] | | I tried it too in a clean Debian Trixie container and got no crash. | |
| ▲ | brazzy a day ago | parent | prev [-] | | This link gets me a shitton of extremely intrusiv ads, some of which look like malware (auto-downloading an "OperaSetup.exe"). Is pastebin already compromised? | | |
| ▲ | tikotus a day ago | parent [-] | | I got this same earlier, but now it seems to be working. Perhaps just an oddly timed bug with some ads that has nothing to do with the incident? | | |
| ▲ | td4 a day ago | parent [-] | | Pastebin is just sketchy for a while now it now serves ads that instantly start those downloads
its been like that for a couple of weeks |
|
|
|
|
| ▲ | sdfgsdfgsdsdfgs a day ago | parent | prev | next [-] |
| On which OS and Server did you run the exploit against? |
|
| ▲ | a day ago | parent | prev [-] |
| [deleted] |
