Comment by janmo

17 hours ago

Cloudflare: "We are seeing early attacks emerging and are updating mitigations as new vectors show up."

https://x.com/dok2001/status/2112811965735202970

When will they finally release the patch?!

35 comments

janmo

Reply
pxtail  17 hours ago

Mindboggling, wtf don't they release it if its ready and exploit is in the wild, its a lot of time until 14:00 UTC and a lot of websites will be breached.

  • janmo  17 hours ago

    They should have shut up, released a new stealth PHP version and told everyone to update ASAP. They gave way to many details ahead allowing some AI agents to find the vulnerability within half an hour...

    • Numerlor  16 hours ago

      The update was withheld because releasing it without notifying major providers and distros would turn it into the same race, with ai having a release is the same thing as a disclosure.

      This would've worked if other people were able to shut up about it. Because its existence got leaked they posted the announcement

      12 replies →

    • Gigachad  16 hours ago

      That doesn’t work anymore because LLMs are scanning the diffs to spot security fixes and can turn it in to a PoC as soon as the commit goes public.

      1 reply →

  • reddalo  17 hours ago

    They'll probably release it earlier, that's what they said in the announcement in case the CVE got leaked sooner.

SSLy  17 hours ago

if the attacks are live then PHP should release the fix NOW.

  • mattbee  16 hours ago

    The reason we (used to) have responsible disclosure timelines is so that the information & software to fix vulnerabilities can be assessed, organised, written up. Builds could get built, attackers and defenders find out at once. But crucially, defenders could use the normal channels to fix their installations and be sure they'd covered themselves.

    When a PoC drops before that timeline is up (like now!) the attackers get a head start because they have less work to do - just figure out how to use it to their payload, start spraying it out.

    Meanwhile maintainers don't want release an incomplete or misunderstood fix. Otherwise they'd risk people updating and believing that they're safe when they're not. Even a fragment of misinformation from an official channel will spread like wildfire. So when you demand fixes NOW you're demanding something that may not be completely understood.

    So (I'm sure we'll find out but) I believe this 2pm timeline was already as soon as is human possible for the PHP team to do a repsonsible job, and not risk us having to come back tomorrow for a fix to the fix.

    LLMs gives attackers the advantage for a while, and it means we'll have to tighten the secrecy around even the rumour of a vulnerability.

    • Dylan16807  16 hours ago

      > Meanwhile maintainers don't want release an incomplete or misunderstood fix.

      > I believe this 2pm timeline was already as soon as is human possible for the PHP team to do a repsonsible job

      I'll be surprised and kind of upset if the fix wasn't already done when they announced the bug and the sub-24-hour release time.

    • oceansweep  8 hours ago

      No, ‘responsible disclosure’ was and always has been a response from vendors not patching their software or building secure software to start with, and trying to frame researchers as responsible for their shoddy work.

      3 replies →

  • bombcar  15 hours ago

    Or you release a "mitigation" immediately (turn off feature X usually) and then release the patch.

    • Hamuko  15 hours ago

      As far as I can tell, there is no proper mitigation beyond patching. Unless we count turning off your service as a mitigation. Cloudflare is currently busy playing whack-a-mole with new vectors so it’s probably not feasible to properly mitigate it on the edge either.

      1 reply →