|
| ▲ | literalAardvark an hour ago | parent | next [-] |
| Under normal configurations the server is highly exploitable. It's a horrible vuln and I don't understand what's with all the flat infosec society coming out of the woodwork. The challenge server had vibe coded infra that made it hard or impossible to hack, but it was a configuration that can't be used in production and no one uses ( it was deployed as a PHP static content server instead of a dynamic site generator ) |
|
| ▲ | Urd- 3 hours ago | parent | prev | next [-] |
| Normal configuration of a PHP server is to not run any PHP code and serve a static html file? |
| |
| ▲ | lifeisloving 2 hours ago | parent [-] | | Where is all the evidence of exploits if most of the webs PHP servers were vulnerable? This is a seperate chained exploit itself, seemingly executed by a nation stae. There are thousands of exploits infiltrating web servers around the world daily, and they arent php2shell. You only care about this because it falls into a weird viral narrative about "AI saftey". | | |
| ▲ | literalAardvark an hour ago | parent [-] | | There's nothing separate about this. Chained just means they used php2shell to run a local privilege escalation. | | |
| ▲ | lifeisloving 10 minutes ago | parent [-] | | Was the exploit not dependent on a kernel exploit that was disclosed and patched in may, or am I just hallucinating? |
|
|
|
|
| ▲ | devin an hour ago | parent | prev | next [-] |
| I had a similar take, but I was wrong. |
| |
|
| ▲ | cowlevel 3 hours ago | parent | prev [-] |
| Which best practices did you use to prevent exploitability? And would you stake your bitcoin on it? |
