Comment by SchizoDuckie
1 day ago
Well great thanks. I need details now. Where, core? Extensions? What config?
My guess is on some request filtering thing
1 day ago
Well great thanks. I need details now. Where, core? Extensions? What config?
My guess is on some request filtering thing
Yes, it's on core. All versions from PHP 5 onwards. Only PHP 8 will be patched.
So a few million WordPress sites are just going to be overnight targets.
Although I guess that's not a dramatic change in the status quo.
It's not. I maintain some WP sites, including one that is so custom that it can't be run on a service like WPEngine. I just assume it will be hacked on a regular basis.
Large swaths of the filesystem are chattr +i'd, non-writeable by the user PHP runs as. I have capabilities and network rules applied so that that context can't communicate outbound on the network. I have a WAF that restricts outbound traffic (normal users never download something as big as even 1 megabyte). I have a set of firewall rules to tarpit any automated scans that come near the site.
Nowadays, I run an AI agent continuously that scans the VM everything is hidden in for any signs of an intrusion, plus the host that contains the VM as well. I make sure that agent is sandboxed as well. (This only costs a few dollars a day in tokens which I bill to the customer.)
After this next world-wide intrusion, I may finally be able to convince the client they need to get off the WordPress e-commerce site that they got a teenage girl to do for free a decade ago.
surely not only 8, that would be insane
Everything before 8.2 is past EOL.
1 reply →
Details are due for disclosure at 1400hrs UTC tomorrow. That timeline may yet change.