Many here call for an earlier release of the patch.

But it is not clear if releasing the fix early would make the damage smaller or larger.

Having the patch probably makes creating an exploit easier. So the number of attacks would increase.

There is no way to coordinate the whole world on an earlier time. I would guess the number of people that have to patch their instances is in the hundreds of thousands.

Everybody who actively watches the topic already has the option to shut down their instances.

So ringing the bell and getting as many people as possible to shut down their webservers now and patching at 14:00 might be the best in terms of damage minimisation.

▲ dmsch 44 minutes ago | parent | next [-]

There are several PoCs, and according to Cloudflare, the vulnerability is already being actively exploited: https://x.com/dok2001/status/2112811965735202970

▲ AndroTux 40 minutes ago | parent | prev | next [-]

> Everybody who actively watches the topic already has the option to shut down their instances.

In theory. In practice, many can't just decide to shut down their service for a few hours.

▲ joshuat 27 minutes ago | parent | prev | next [-]

fwiw it looks like the patches were made available early on chainguard

https://images.chainguard.dev/directory/image/php/versions

▲ fredsted an hour ago | parent | prev | next [-]

There's an exploit freely available already, by the way. You can't contain things like this.

If not, you or our agent could build an exploit from the information that's already out.

▲ TekMol an hour ago | parent | next [-]

I have not seen confirmation that the exploit is for the bug that is going to be patched.

It seems the published exploit can be easily prevented by filtering out multipart post requests. So people actively watching the situation can already prevent that issue by filtering those.

▲ cinpol an hour ago | parent | prev | next [-]

Are you 100% sure? I have tested 2 PoC's against my dev environment, no luck so far. So I am not sure if there is working exploit already.

▲ system2 an hour ago | parent | prev [-]

I was able to cook up something in less than 10 minutes and tested many sites. There is a page with enough explanations to do it.

▲ rtuin an hour ago | parent [-]

Did you successfully run a RCE test, or only a vulnerability check? So far all write-ups and PoC's i've found fail to "cash in" on the RCE part.

▲ system2 an hour ago | parent [-]

I was able to bring it to the point of memory corruption. It is 3 am where I am now; I will continue in the morning. As a precaution, I configured .htaccess rule.

  # BEGIN php2shell-mitigation
  <IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTP:Content-Type} multipart [NC]
  RewriteRule .* - [F,L]
  </IfModule>
  <If "%{HTTP:Content-Type} =~ /multipart/i">
  Require all denied
  </If>
  # END php2shell-mitigation

I added a rewritecond to ignore multipart before php-fpm receives anything. I did a similar thing for nginx servers. Also in .user.ini added "session.upload_progress.enabled = Off".

These two seem to do the trick, but again I am not 1000% sure until tomorrow morning's deeper dive. My eyes are burning, and I can't sleep because of the stress this exploit.

	▲	Macuyiko 41 minutes ago \| parent [-]
		I've done the same in caddy: @multipart header_regexp Content-Type (?i)multipart respond @multipart 403 @uploads_php path_regexp uploads_php ^/(?:./)?wp-content/uploads/.\.php(?:/.*)?respond @uploads_php 404 Plus the php.ini changes, "session.upload_progress.enabled = Off" and strict mode. Let's hope it holds until then

▲ shevy-java 35 minutes ago | parent | prev [-]

> Having the patch probably makes creating an exploit easier. So the number of attacks would increase.

No matter the excuse, the security issue must be fixed. Anyone trying to delay this is not acting in good faith. I understand your rationale but that does not excuse you from being labelled as such too.

We should live in the age of open source AT ALL TIMES. No exceptions, for anyone, no matter the reasons. And that includes those who want to withhold code or patches.