Comment by chrisvenum
14 hours ago
Just made the call to take all my customers apps offline until this is fixed.
Can’t find any reliable information on what to do prior to the patch, seen some info that turning off session progress does not mitigate.
Anyway.. back to calling everyone
I took my services offline last night, wouldn't have been able to sleep otherwise. There has been core PHP members that have outright said the mitigation's currently doing the rounds won't help and even cloudflare can only mitigate against known attack payloads.
The maintainer's comments are singularly unhelpful - "there's nothing you can do, just curl up and die" is pretty useless when you're faced with "take the entire company site offline" vs "maybe get exploited."
The comments aren't unhelpful, they're in fact very helpfully telling you that "take the entire company site offline" is the only safe choice right now.
3 replies →
Yes, that's not very well done: when you are handling big IT services, you need more than "a person wrote a scary thing on twitter" to justify such an impacting action
3 replies →