← Back to context

Comment by bwoebi

21 hours ago

For everyone wondering why the patch is not out yet:

There are a handful people responsible for doing a release. They are still asleep.

To be honest, I am also shocked, that the exploit was published that quickly, after the leaked video (which was the reason, why the announcement happened in the first place, at that specific time). We expected a bit more time, even with LLMs...

56 comments

bwoebi

Reply
ftfyyyyyy  18 hours ago

https://images.chainguard.dev/directory/image/php looks like patched builds for 8.5-8.2 are available here

  • dlor  18 hours ago

    We've been working with the team on the coordinated disclosure, but I made the call to get these out early when exploits hit in the wild.

    The vulnerability and patch are both very complex, and the maintainers did an incredible job on this one. We tested the patch extensively and it's holding up well.

    We've made these images free and will keep them that way.

    • rgj  5 hours ago

      Any comments on this? https://www.reddit.com/r/PHP/comments/1xbpbiu/comment/19rg36...

      "We took our website down this morning when the "PoC"s were released, only serving a static website. Our customers were not pleased. Then we got contacted by Chainguard affiliates using our public support form if we would like to schedule a meeting with them, so that they could sell us their security services."

    • thenaderman  16 hours ago

      What an incredible irresponsible move essentially 0-daying everyone who was working toward coordinated disclosure to ensure everyone had images or distro packages to update to.

      16 replies →

    • dhruvagoyal  6 hours ago

      I find it really interesting how no one has been able to produce a POC after the blogs hit the public. Something key was probably omitted from the disclosure to prevent exactly this.

      1 reply →

    • Roark66  10 hours ago

      I for one say thank you. The embargoes do nothing if the thing is being exploited in the wild.

summner  17 hours ago

today only a rumour of a bug is enough to find and replicate it quickly.

anything that narrows the searchspace

joshuat  15 hours ago

Good for them to be able to sleep the night before this chaos was meant to erupt, earnestly.

jwitthuhn  20 hours ago

Hopefully the industry will learn something about how withholding fixes to known vulnerabilities is, in fact, bad policy.

  • my-huge-pony  16 hours ago

    How? Biggest organisations and shared hosting providers had a chance to patch and protect their users. Everyone else will learn about the vulnerability the second patch comes out (this is also fixable with a configuration chance, so nobody needs to wait for their distro). This was the right approach and it worked.

    • jwitthuhn  16 hours ago

      They didn't release the patch out of fear that someone would quickly use the patch to develop an exploit, meaning an exploit is available shortly after the patch.

      What they have achieved by delaying the patch is that exploits are now available publicly before a patch.

      Surely this is the worse outcome.

      2 replies →

    • ameliaquining  16 hours ago

      The problem is that, since proofs-of-concept have leaked but the patch isn't available, bad guys can attack any site whose operators aren't part of the club, and the only thing the operators can really do to prevent that is to take the site offline. (PHP core team has denied that the configuration change fixes the problem.) I would call this a significantly worse outcome than everyone finding out about the vulnerability at the same time, since in that case operators can take timely action if they get the news quickly enough.

      1 reply →

  • heresie-dabord  18 hours ago

    > the industry will learn something

    This is something of a fallacy. "The Industry" cannot learn.

    But laws and regulations can require better security.

    As in the history of seatbelts in vehicles, tech tool stacks are insecure by design and no one is ever really held accountable... until the cost is deemed too high.

    It's evident that we have not reached that limit yet.

thenaderman  16 hours ago

This is nonsense, disappointed to see that publicly from a core dev. Yes, some people are asleep, but the decision was made to wait, to ensure the patch is only made available when users are actually able to install the update and we're giving distros the time to build PHP packages.

jacquesm  15 hours ago

> We expected a bit more time, even with LLMs...

That's horribly naive with an installed base this size and if you are that geographically dependent then I would hope to read how this will be dealt with going forward.

  • Macha  12 hours ago

    So how much do you pay the php foundation for 24/7 support?

    • jacquesm  11 hours ago

      Can you please explain what you mean rather than asking questions like this?

      I think you are assuming I am running PHP which I haven't used in production for more than a decade. That doesn't change the fact that if you power this many websites that you should have a plan in place for when there is a critical issue.

Shank  16 hours ago

Honestly, kindarails2shell resulted in a responsible disclosure coordination followed by the decision to release early since it was reversed too quickly. Even just a hint of a 0-day is enough to cause people to look for it and exploit it with LLMs.

baggy_trough  21 hours ago

[flagged]

  • 27183  21 hours ago

    lmfao what... If the police woke me up to fix anything the only thing they'd get out of me is "lawyer". And I wouldn't put a single iota of effort into fixing that thing until the entire matter with the police was resolved. If you want someone's attention on something, especially something nuanced and intricate like a software bug, that's absolutely not how you get it.