Rendered at 02:56:06 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
joshuat 38 minutes ago [-]
If the rumors for these exploits being shared on Twitter are correct this is going to be a nightmare. I wouldn't be surprised if VPS hosts step in to mitigate it somehow since so many cheap/unmaintained LAMP installs are running on those servers.
redox99 16 minutes ago [-]
The exploit is already out. Yeah this looks like it's going to go on history as the worst vulnerability ever. And now with LLMs you'll likely see tens of thousands of agents hacking any php website out there within hours.
spenvo 4 minutes ago [-]
Yup, I'm seeing several legit people on X claiming to have seen or found the exploit. Some say that: turning session.upload_progress.enabled off and setting file_uploads = Off will mitigate. But others are claiming that those steps are not enough and "Upload progress can serialize before basic RINT clears BG(serialize)". So, I'm taking no chances and taking my services offline.
Gigachad 3 hours ago [-]
The demo video has been going around Twitter today and apparently the proof of concept is privately being shared around too. The video shows pasting something in the URL and then gaining a shell on the server. It looks completely catastrophic.
I think the best course of action is to just shut your server down before the patch goes live and then bring it back after you have patched.
This is gonna rinse so many LAMP WordPress installs where the PHP version is either not getting a patch or the hosting is managed by the user via a contractor or the hosting is managed by a company with a fleet of custom servers etc etc.
Gigachad 26 minutes ago [-]
We almost need some bot that logs in to every vulnerable PHP server and turns it off to prevent it being properly exploited before the server admin updates it..
lioeters 12 minutes ago [-]
Kindware instead of malware. Just goes around finding vulnerabilities and using them to patch things and improve security everywhere.
dangoodmanUT 10 minutes ago [-]
That is definitely very not good.
I got into software dev because of cyber sec, and almost everything I learned revolved around poorly implemented php, so I always stayed away from it when building
but this time it's php directly? that's scary
mircerlancerous 4 minutes ago [-]
There are regular security patches for basically everything these days, including OSs. Why does this notice stand out to you? The post suggests that they're being proactive, and discovered and patched these before they were exploited. Rather they take this transparent approach, as opposed to being silent and/or doing nothing.
I think the best course of action is to just shut your server down before the patch goes live and then bring it back after you have patched.
I got into software dev because of cyber sec, and almost everything I learned revolved around poorly implemented php, so I always stayed away from it when building
but this time it's php directly? that's scary
php.ini:
Are you speaking officially here?
There are various mitigations suggested online, including completely blocking multipart requests at LB level. Is the combination of both effective?
I shut down my servers five hours ago. This might have seemed premature at the time.
I think the best course of advice for most people is to shut down their servers as soon as they possibly can.
https://cert.europa.eu/publications/security-advisories/2026...
> affect PHP versions 5, 6, 7, and 8.
https://www.bleepingcomputer.com/news/security/php-warns-adm... (which references HN as a source - https://news.ycombinator.com/item?id=50167754)