I think there's still going to be a massive long tail of sites that will never be protected or upgraded, unfortunately that's the reality. So no amount of delay will help them, and most active sites will have patched by now after 5 days.

There are already many people claiming they have an exploit, some in this thread, I think this is a useful measure of just how easy it is - thankfully it doesn't look too easy as it's still up at time of writing, though surely someone will manage it soon.

If it does get taken quickly I think that's useful information on just how serious this is.

If it doesn't, that's also useful info though not hard proof there is no exploit. It does mean that there is no exploit in the hands of script kiddies with chatgpt or similar.

▲

athrowaway3z 3 hours ago | parent | next [-]

I too have various websites that dont get hacked.

I'm not sure what this page proves except that not all set-ups are in danger. Especially if the site does nothing and has a nginx in front that caps all requests to 1mb.

There are, afaict, at least half a dozen choices a PHP server could have made that mitigates all (known) exploits. Putting some bitcoins behind one of them isn't exactly proof of anything, except as a PR stunt to convince people PHP is not a pile of tightly coupled hot-c garbage.

---

Other projects that get CVEs talk about what went wrong and how to improve. So far i've only seen PHP people defensive and telling each other that ok because other projects also get CVEs.

▲

zkldi 3 hours ago | parent [-]

Hey, you're leaving out that nginx's default is to cap at 1m, btw.

▲

athrowaway3z 3 hours ago | parent [-]

The Dutch government websites that went down have multiple endpoints to upload files that do not have a 1MiB cap.

	▲	zkldi 3 hours ago \| parent [-]
		But the Dutch government websites do generally (I hope) have users, which is one of the ways the "I need to hit the same php worker, uninterrupted, for about 10 to 30 seconds while absolutely no other traffic hits the site AND I can isolate the one worker from the pool" approach to exploiting fails. Luck is not a security boundary, they should patch their servers, everyone should. It's not a good thing to have shitty memory management on your server. However, is this really that exploitable in real world conditions? (no)

▲

hparadiz 3 hours ago | parent | prev [-]

Shared host Wordpress sites basically run in unprotected untrusted mode since WP has so many RCEs already and they can be in any random plugin someone adds at any time. So even if there's an RCE a lot of these sites just shrug at the attack. You would need to figure out how to chain it for something useful.