Comment by compass_copium
14 hours ago
The comments aren't unhelpful, they're in fact very helpfully telling you that "take the entire company site offline" is the only safe choice right now.
14 hours ago
The comments aren't unhelpful, they're in fact very helpfully telling you that "take the entire company site offline" is the only safe choice right now.
But that's exactly why it is unhelpful. "Take your site offline" is always safe - but we don't have enough information to make the decision informed.
"X may mitigate some of the active attacks" is helpful - you can evaluate if X impacts you, and make a choice.
"Y is how we're seeing the attacks" is helpful - you can setup logging to see if you're being exploited.
"Z reduces but we can't say it eliminates the risk" is similar.
"SHUT IT ALL DOWN" doesn't do much but make good noise and increase the chance that the next one is considered to be a "boy-crying-wolf" scenario.
(Of course, taking all dev/test/unimportant sites down for a few hours is painless, but Wordpress/PHP runs some of the biggest sites in the world.)
So what if there are no known mitigations and it's such an open attack surface that logging doesn't help in containing it?
Since you wrote your comment the official blog posts describing what exactly is the in the exploit have been released, and "shut it all down" was definitely the right advice to give.