Comment by Gigachad
1 day ago
The demo video has been going around Twitter today and apparently the proof of concept is privately being shared around too. The video shows pasting something in the URL and then gaining a shell on the server. It looks completely catastrophic.
I think the best course of action is to just shut your server down before the patch goes live and then bring it back after you have patched.
The URL is to show the effects of the exploit. The person's running a python script that runs the exploit and then makes the PHP installation execute an arbitrary shell command. The proof of concept involves writing "pwned" to a publicly accessible location on the web server, then they refresh the browser pointing at the URL to show it's been written.
https://x.com/k_firsov/status/2112641845926989944
This is gonna rinse so many LAMP WordPress installs where the PHP version is either not getting a patch or the hosting is managed by the user via a contractor or the hosting is managed by a company with a fleet of custom servers etc etc.
I can think of some really ancient phpBB boards that probably won't ever come back if they get hit.
They might be fine if they are still on php4...
It's sad how many wordpress installs haven't been patched in a decade. they're so old even new exploits aren't supported.
ha! Who knew ignoring critical updates and continuing to run deprecated software while kicking the can down the road while focusing solely on building new features would turn out to be the best security policy after all.
1 reply →
We almost need some bot that logs in to every vulnerable PHP server and turns it off to prevent it being properly exploited before the server admin updates it..
Kindware instead of malware. Just goes around finding vulnerabilities and using them to patch things and improve security everywhere.
2 replies →
If people wait too long you could even have the bot use the exploit to update the PHP version.
Nice idea, but I don't think you would want e.g. your hospital to have their systems suddenly turn off.
18 replies →
I’ve thought about doing this in the past but have no trust in police to see it as a Good Samaritan act
dozens of thousands if not hundreds of Drupal 7 sites running php 7