I think the point is it is hard to claim that this exploit is the "end of the world", if it is trivially defeated by the default setup. Almost every deployment of php is going to be fronted by apache or nginx, and the default client_max_body_size for nginx is 1m.

▲

LiveOverflow 4 hours ago | parent [-]

I didn't say it's "end of the world". I am just saying it's an insane vulnerability.

It's not easily defeated by the default setup. Quite the contrary, the default setups are great. Typical apache + mod_php is the easiest to exploit. For example:

- Docker image `php:8.5.11-apache` is easy to exploit.

- Or the WordPress blog I installed with Digital Ocean template in 2023.

	▲	tredre3 an hour ago \| parent [-]
		> It's not easily defeated by the default setup. Quite the contrary, the default setups are great. Typical apache + mod_php is the easiest to exploit. But apache + mod_php hasn't been the default setup for a very long time, that's what people are trying to tell you. Given your expertise, you must know that already. So I have to conclude that you're arguing in bad faith because it's the only setup you can break.