The most direct exploit requires a compromised supply chain which ranks it about as dangerous as your usual dependency exploits.

▲

CER10TY 6 hours ago | parent | next [-]

Say what you will about OpenAI, Wiz etc but if OpenAI, Wiz, Cloudflare, the PHP Foundation and pretty much every CERT out there together recommend to take down PHP apps and patch immediately then I'm very much inclined to follow that advice.

Due to the insane media coverage there'll of course be a deluge of PoCs, most of which won't work. But constantly refreshing Twitter to see whether there's a working PoC is not a good use of time nor a great security strategy.

▲

tptacek 6 hours ago | parent | prev [-]

I think this is just false? Are we playing some kind of weird game of telephone? Is the term "direct exploit" doing way more work in that sentence than you mean it to?

▲

Onavo 6 hours ago | parent [-]

The alternative route through the web forms requires the absence of ASLR. So you need to spam the endpoint, like a lot. You can probably mitigate at the edge (CDNs) or perhaps at the reverse proxy level (NGINX) through e.g. rate limiting. More of a web version of row hammer then some sort of trivial SQL injection attack that works consistently.

Maybe a LAMP stack on an extremely ancient version of Linux is vulnerable out of the box. Quit the fear mongering please, you do the security community no favors.

▲

milkshakes 2 hours ago | parent [-]

so confident so completely incorrect

educate yourself

https://oliviagallucci.com/aslr-bypass-techniques-and-circum...

▲

Onavo 2 hours ago | parent [-]

[flagged]

	▲	milkshakes 2 hours ago \| parent [-]
		[dead]