Can anyone explain the two month window between reporting and disclosure? I do understand Responsible Disclosure as a concept, but looking at the timeline and severity, I struggle to understand the timing, especially the month that passed before an acknowledgment.

Edit: Apparently this had been reported more than half a decade ago [0]. I am getting more confused the more I look into this, hopeful for a well written, factual post-mortem from someone who hasn't actively avoided PHP for the last decade.

[0] https://news.ycombinator.com/item?id=50181395

▲

kylestanfield 3 hours ago | parent | next [-]

How is a bug that was patched six years ago causing RCE today? Not sure your link is correct.

	▲	blantonl 3 hours ago \| parent [-]
		6 years ago it was deemed to be too complex to exploit and therefore not as high priority.

▲

phoronixrly 4 hours ago | parent | prev | next [-]

Can anyone explain the lack of the irresponsible disclosure in the 'Responsible' disclosure timeline? The one that happened just before the coordinated release?

▲

AtNightWeCode 3 hours ago | parent | prev | next [-]

People should stop reading AI slop on X and other social media. The exploit is advanced and took some effort to fix. If there really was an open RCE in PHP for anyone to use the impact would be massive.

▲

Topfi 3 hours ago | parent [-]

Sorry, what do you mean? There was/is an open RCE in PHP and the impact was/is massive. Pity the teams on older versions especially.

▲

AtNightWeCode 2 hours ago | parent [-]

So what sites are confirmed to be "hacked" cause of this exploit? I mean, Log4J broke Minecraft and a lot of other services.

	▲	Topfi 2 hours ago \| parent [-]
		We don't know yet. Not sure how that changes things either way. Impact goes far beyond getting exploited and the leak wasn't ideal in that regard either.

▲

varispeed 3 hours ago | parent | prev [-]

Many exploits are used by security services, so this gives time to wrap any investigations or surveillance or find another method of accessing target servers.