Comment by ftfyyyyyy
21 hours ago
https://images.chainguard.dev/directory/image/php looks like patched builds for 8.5-8.2 are available here
21 hours ago
https://images.chainguard.dev/directory/image/php looks like patched builds for 8.5-8.2 are available here
We've been working with the team on the coordinated disclosure, but I made the call to get these out early when exploits hit in the wild.
The vulnerability and patch are both very complex, and the maintainers did an incredible job on this one. We tested the patch extensively and it's holding up well.
We've made these images free and will keep them that way.
Any comments on this? https://www.reddit.com/r/PHP/comments/1xbpbiu/comment/19rg36...
"We took our website down this morning when the "PoC"s were released, only serving a static website. Our customers were not pleased. Then we got contacted by Chainguard affiliates using our public support form if we would like to schedule a meeting with them, so that they could sell us their security services."
What an incredible irresponsible move essentially 0-daying everyone who was working toward coordinated disclosure to ensure everyone had images or distro packages to update to.
An exploit is already in the wild. What seems irresponsible is not adapting to a new reality.
15 replies →
I find it really interesting how no one has been able to produce a POC after the blogs hit the public. Something key was probably omitted from the disclosure to prevent exactly this.
https://github.com/david-alvarez-rosa/php-rce
Bravo. We finally have a clear example on what not to do.
Sorry the last images I see are from 13 hours ago. Are those for the 2 RCE ones?
I for one say thank you. The embargoes do nothing if the thing is being exploited in the wild.