Which kind of makes sense, I think a lot of Dutch websites have been taken offline. I think it’s due to recent regulations that have been introduced.

I think, given the (supposed) seriousness of this issue, it’s an adequate response. I suspect Cloudflare et al will have rules added to their managed WAFs within a few hours after release as well.

That said: it seems like the core issue is that they can’t release PHP publicly without revealing the exploit, wouldn’t it have made more sense to coordinate in the background with these organizations, and important distros, so that this could have been patched without revealing the exploit?

▲

jerf 3 hours ago | parent | next [-]

It creates an absolutely enormous political snarl to decide who is "worthy" of getting advance notice on something like this, and to correctly determine who is capable of keeping the secret in the presence of highly motivated active attackers who may have capabilities all the way up to and including "state level actors".

Basically, it's only possible in our imaginations where we don't have to get into the nitty-gritty of exactly who gets what notifications. It isn't possible in reality for something this large and consequential.

▲

jaydenkieran 6 hours ago | parent | prev | next [-]

Cloudflare have already deployed WAF managed rules to help mitigate the vuln: https://x.com/dok2001/status/2112811965735202970

But they say it's a stopgap and still advise patching. It makes sense, since their tweet also says "are updating mitigations as new vectors show up" so it seems like there are many ways to exploit this, whatever it is.

▲

apexalpha 5 hours ago | parent [-]

A WAF can block known _exploits_ it doesn't prevent the vulnerability from being abused by a new / other / slightly changed exploit.

	▲	bcvvvy 2 hours ago \| parent \| next [-]
		Also a WAF isn't magical. I remember the whole 8KiB AWS WAF bypass thing.
	▲	esseph 5 hours ago \| parent \| prev [-]
		You also just described system patching.

▲

trollbridge 6 hours ago | parent | prev | next [-]

I expect that Cloudflare already knows some details of the problem and will have the rules up within minutes or seconds.

▲

meffmadd 5 hours ago | parent | prev | next [-]

Yes our university is doing the same right now! They where thinking of putting the whole network behind VPN access to protect the poor sysadmins in the Institutes that have not updated their website in years…

▲

martijnvds 6 hours ago | parent | prev | next [-]

All it takes is one small leak. Which seems to be what happened here.

	▲	stingraycharles 6 hours ago \| parent [-]
		Ah, so you’re saying that proper orchestration was happening, it’s just that someone leaked it?

▲

rapnie 6 hours ago | parent | prev [-]

> Which kind of makes sense, I think a lot of Dutch websites have been taken offline.

Europa.eu and all related subdomains were down very early CEST morning. They run Drupal.