The only reason Php2shell wasn't as bad as it could've been was because basically no malicious actors had exploits that were useful in time.

Whoever broke the embargo is a moron and it could have resulted in much more damage than was done.

▲

grey-area 3 hours ago | parent | next [-]

I think there's still going to be a massive long tail of sites that will never be protected or upgraded, unfortunately that's the reality. So no amount of delay will help them, and most active sites will have patched by now after 5 days.

There are already many people claiming they have an exploit, some in this thread, I think this is a useful measure of just how easy it is - thankfully it doesn't look too easy as it's still up at time of writing, though surely someone will manage it soon.

If it does get taken quickly I think that's useful information on just how serious this is.

If it doesn't, that's also useful info though not hard proof there is no exploit. It does mean that there is no exploit in the hands of script kiddies with chatgpt or similar.

▲

athrowaway3z 3 hours ago | parent | next [-]

I too have various websites that dont get hacked.

I'm not sure what this page proves except that not all set-ups are in danger. Especially if the site does nothing and has a nginx in front that caps all requests to 1mb.

There are, afaict, at least half a dozen choices a PHP server could have made that mitigates all (known) exploits. Putting some bitcoins behind one of them isn't exactly proof of anything, except as a PR stunt to convince people PHP is not a pile of tightly coupled hot-c garbage.

---

Other projects that get CVEs talk about what went wrong and how to improve. So far i've only seen PHP people defensive and telling each other that ok because other projects also get CVEs.

▲

zkldi 3 hours ago | parent [-]

Hey, you're leaving out that nginx's default is to cap at 1m, btw.

▲

athrowaway3z 3 hours ago | parent [-]

The Dutch government websites that went down have multiple endpoints to upload files that do not have a 1MiB cap.

	▲	zkldi 3 hours ago \| parent [-]
		But the Dutch government websites do generally (I hope) have users, which is one of the ways the "I need to hit the same php worker, uninterrupted, for about 10 to 30 seconds while absolutely no other traffic hits the site AND I can isolate the one worker from the pool" approach to exploiting fails. Luck is not a security boundary, they should patch their servers, everyone should. It's not a good thing to have shitty memory management on your server. However, is this really that exploitable in real world conditions? (no)

▲

hparadiz 3 hours ago | parent | prev [-]

Shared host Wordpress sites basically run in unprotected untrusted mode since WP has so many RCEs already and they can be in any random plugin someone adds at any time. So even if there's an RCE a lot of these sites just shrug at the attack. You would need to figure out how to chain it for something useful.

▲

malfist 3 hours ago | parent | prev [-]

But wait, weren't we all told that exploits where already happening all over the place and thats why the embargo was broken?

Cloudflare even claimed they mitigated a bunch of it.

Which is true here? There was widespread usage of this exploit prior to the patch and just after, or that there were "basically no malicious actors had exploits"?

	▲	DetroitThrow 3 hours ago \| parent [-]
		There's a lot of smoke being blown by companies with a financial stake in coming off as "security-minded" or something. There's apparently _some_ exploit usage in the wild before the embargo breaking, but it very much looks like they didn't even achieve RCE, or if they did it was not widespread at all. It doesn't mean it wasn't possible by a group more sophisticated, it just didn't happen thankfully. After the embargo was broken, RCEs were still not widespread, especially not before a huge number of sites patched themselves. So, no, the narrative that skids with agents were busting down doors as soon as the embargo was broken is not accurate. But breaking the embargo before a patch was ready only hurt the situation for defenders.