https://www.bbc.co.uk/news/live/ckgel5xp2xv9t?post=asset%3Ac8185d02-3e14-4e83-9a99-6d3be2de04bd#post

How it should work for 99% of websites.

https://motherfuckingwebsite.com/

Wow! That's why I love analogies -- in most cases they don't make any sense especially if you are not a specialist in the theme.

Wait till you learn about this new CGI thing, you'll be amazed about what it can do: https://en.wikipedia.org/wiki/Common_Gateway_Interface

most people who have seen the old internet probably feel this rage

Ublock blocks this for some reason

EDIT turns out the reason is it appears to be infected with a botnet

Why is everybody talking about PHP lately? Am I out of the loop?

They fixed a bunch of vulnerabilities there which were known for years but neither hackers nor PHP developers cared much until recently.

Not in Librewolf, at least. Ublock and Noscript enabled. Site still shows.

You probably don't have these filter lists enabled:
📒 HaGeZi - Multi PRO mini
🔐 HaGeZi - Threat Intelligence Feeds - Mini

I doubt it will cook burgers for you though 😕 😔 🍔🍴🤤

For some reason I am hungry all of a sudden...

Wait it was known!? They didn't just discover it and fixed it quickly?

No, they chewed snots for years because there wasn't a trivial and straightforward fix and exploit looked too "theoretically possible". But some time ago(months? year?) some company showed them a working exploit, so they started to think how to actually fix the problem. All that time they kept all in secret so hackers wouldn't know. But the fix had leaked, letting hackers to figure out what was the vulnerability in the first place, so snot-chewing was replaced with running-and-screaming. By now everything is fixed for those who cared to update\recompile. Something like that.

Well, they do have some prose in the link that OP also posted, but yeah, it is a bit rough, especially if you're trying to understand the vulnerability..

Most of my experience with PHP is from pen testing so most of my orders look something like <?$_GET[0]?>

To add what the others said, yesterday morning there was news that every php version is vulnerable but the fixes were published very late in the day (or whenever depending on timezone) thus there was a 8+hours of unceartiny and fear for administrators. A lot of websites shut down due to that.

holy fuck

70% of websites are running PHP?

are they sure?

Am I going to find a php binary in a node_modules directory

It's not a quick or easy fix. The patch is a 10000 line nightmare. No really it's actually 10k. A lot of that is test code, but there are also significant changes to deep engine internals.

PHP did really really bad memory limit handling. Now it's only really bad.

Thanks, makes sense!

Wow scary fix, I'm guessing we're going to be seeing a few new patches really soon fixing bugs created by this latest version

That's weird. I did some digging and can't find its name, ip, or hosting company servrex.com on any block list. I checked HaGezi on github based on your post.

I used this https://github.com/hagezi/dns-blocklists#listlookup and searched https://motherfuckingwebsite.com

If you search the closed github issues, you'll see more details for the url

CSS didn't do shit wrong:

http://bettermotherfuckingwebsite.com/

Dam, I guess I was a programmer at KFC, and I didn't even know it...

Step 5. you inject poison in your burger and send it back. Causing the cook to die and you take over as the owner of the restaurant

Which list? I searched the Multi Ultimate Full list and it wasn't there.

I kinda buy the 70% claim, mostly because lots of old CMS systems are built using PHP some of which are still extremely popular like wordpress.

Adguard blocks it. Adguard usually is more trustworthy

https://github.com/hagezi/dns-blocklists/issues/11017

https://github.com/hagezi/dns-blocklists/issues/12026

Well that's even weirder. It is in a list labeled malicious/scammer/fishing.

It absolutely isn't any of those.

Someone else claimed it pulls resources from a botnet but if you view source, that isn't true.

Well, I didn't check its internals.

The cook should be represented as the database.

Back in the 80's, my brother "hacked" a pizza place because he knew how they wrote green olives and black olives on their ticket. He dated a girl who worked there for a stint.

I don't remember how it worked and he has since passed, but it was something with the order that he would list the toppings that would fuck up the cook, so the order always came out wrong and boom! Free pizza.

Love this one. Only thing I don't get is why so many people can't stand high contrast. Or even go so far as to say white background hurts their eyes. Black on white is just fine, thank you very much. And if it is too harsh, then I suspect that actually either one's monitor is too bright, or - more likely - the environment they're in is too dim.

the person getting the burger actually has a user agent which fetches the burger for them. Its a food delivery app and the browser is doordash/uber eats etc. Instead of packets its human beings who read a screen and understand obligations.

Can we get Samuel L. Jackson to read it for those with vision impairment?

4

over half of that 70% is just wordpress.

Can ypu add to the github issue asking to review it?

Looks like someone already did.