Comment by dlor
17 hours ago
We've been working with the team on the coordinated disclosure, but I made the call to get these out early when exploits hit in the wild.
The vulnerability and patch are both very complex, and the maintainers did an incredible job on this one. We tested the patch extensively and it's holding up well.
We've made these images free and will keep them that way.
Any comments on this? https://www.reddit.com/r/PHP/comments/1xbpbiu/comment/19rg36...
"We took our website down this morning when the "PoC"s were released, only serving a static website. Our customers were not pleased. Then we got contacted by Chainguard affiliates using our public support form if we would like to schedule a meeting with them, so that they could sell us their security services."
What an incredible irresponsible move essentially 0-daying everyone who was working toward coordinated disclosure to ensure everyone had images or distro packages to update to.
An exploit is already in the wild. What seems irresponsible is not adapting to a new reality.
Yes but they obtained this information based on the one-sided courtesy of another party, under a scheme that tried to get as many people to safeguard together.
If the first party to receive this information says, "Wow, of course I must act on this, because customers are on the line," then it makes sense to simply choose who you tell more carefully or not at all.
2 replies →
Publishing a patch beforehand potentially multiplies the impact. Now the actual bug(s) can be diffed from the source. Whereas existing PoCs (after verifying whether it even works), obfuscated at least a bit about the details. It is not so clear what is the best approach.
1 reply →
Was the exploit made, from reverse-engineering, this early release? Because that is how I'd do it.
4 replies →
No.
If you want to 'adopt' a new reality, you talk to all parties, and everyone moves up the release. That's how agreements and trust work. If you don't do so? No one will trust you ever again.
And?
You won't be at the table next time.
4 replies →
I find it really interesting how no one has been able to produce a POC after the blogs hit the public. Something key was probably omitted from the disclosure to prevent exactly this.
https://github.com/david-alvarez-rosa/php-rce
Sorry the last images I see are from 13 hours ago. Are those for the 2 RCE ones?
I for one say thank you. The embargoes do nothing if the thing is being exploited in the wild.