Comment by dawnerd
21 hours ago
I tried it on a personal site, was able to dump the entire database. Immediately shut all my sites down. This is bad.
21 hours ago
I tried it on a personal site, was able to dump the entire database. Immediately shut all my sites down. This is bad.
Years ago I migrated all my personal sites to being statically generated, since they don't have actual dynamic content anyway. That was a good decision.
Same here. And for the dynamic content, I host dedicated, small services, or client side code.
Not only 10 years of no more security updates. But hosting static content is cheap, performant and sustainable. Bot literally (you can move the content anywhere, using any kind of server) and in energy sense.
While I understand it is not for everyone to write markdown files and run build commands, I strongly urge anyone with a WordPress or drupal site to give the various jamstacks, or static site builders and guis a test run.
How can I try this to see if I should shut things down myself. I run a 6 figure stealth and have a day job for fintech in 9 figures all php so kinda worried
Used this as a base: https://jackalsyn.com/posts/php-up-2026.html
But created my own based on it since it feels sketchy running someone else's exploit poc ya know. Ran it first in a vm before running it against a production site.
They've retracted RCE capabilities from that site, said they made a mistake and it's a crash bug. So what base did you use?
I ran the PoC on my dev environment, the PoC is not complete and does not work.
I tried this more simplistic variant https://pastebin.com/kggc4q1T which supposedly would crash php but it was rejected by my CSRF middleware...
13 replies →
On which OS and Server did you run the exploit against?
You make 9 figures at a fintech? Are you hiring?
Fintech makes 9 figures. I make 6 there and 6 at my stealth :-)
6 replies →
You use PHP at a fintech?
One of many languages. It has its role.
1 reply →
Given that the base you ran against was faulty and not actually RCE, I'm starting to get sceptical of the truth of your highly upvoted comment.
Was apparently enough of a lead for codex to run with (daybreak). Haven’t woken up enough yet to compare it to anything released yet.
Does the exploit need a framework like laravel or can it work with just plain php
No, this happens sometime in the request parsing process, any exposed php URL would be vulnerable.
Meh, I'll just roll PROD back to our 4.7 image, then head down to the pub for a pint until this all blows over... Only 3 years of data will be missing... No biggie! LOL :P