RetroFed Forum
Your home away from modern life.
Big not-yet-disclosed PHP vulnerability
Post Reply
AuthorMessage
chicken lemmy.dbzer0.com chicken@lemmy.dbzer0.com
Joined: 2023-06-30
Quote

66   Original
Onno (VK6FLAB) lemmy.radio vk6flab@lemmy.radio
Joined: 2024-03-04
#2 · Quote Reply

The server has been hugged to death .. I wonder why 😁

1
GottaHaveFaith fedia.io GottaHaveFaith@fedia.io
Joined: 2024-07-08
#3 · Quote Reply

POC at https://jackalsyn.com/posts/php-up-2026.html

2
hirihit640 sh.itjust.works hirihit640@sh.itjust.works
Joined: 2024-10-28
#4 · Quote Reply

Related discussion on hacker news: https://news.ycombinator.com/item?id=50172041

The demo video has been going around Twitter today and apparently the proof of concept is privately being shared around too. The video shows pasting something in the URL and then gaining a shell on the server. It looks completely catastrophic.

I think the best course of action is to just shut your server down before the patch goes live and then bring it back after you have patched.

video here: https://twitter.com/k_firsov/status/2112641845926989944

(Look for a Nitter instance if you don't want to use twitter)

2
Post Reply
Back to top