Comment by Topfi

12 hours ago

Can anyone explain the two month window between reporting and disclosure? I do understand Responsible Disclosure as a concept, but looking at the timeline and severity, I struggle to understand the timing, especially the month that passed before an acknowledgment.

Edit: Apparently this had been reported more than half a decade ago [0]. I am getting more confused the more I look into this, hopeful for a well written, factual post-mortem from someone who hasn't actively avoided PHP for the last decade.

[0] https://news.ycombinator.com/item?id=50181395

11 comments

Topfi

Reply
phoronixrly  12 hours ago

Can anyone explain the lack of the irresponsible disclosure in the 'Responsible' disclosure timeline? The one that happened just before the coordinated release?

  • phoronixrly  8 hours ago

    Here's the missing part, as per the PHP announcement

    > On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.

AtNightWeCode  11 hours ago

People should stop reading AI slop on X and other social media. The exploit is advanced and took some effort to fix. If there really was an open RCE in PHP for anyone to use the impact would be massive.

  • Topfi  10 hours ago

    Sorry, what do you mean? There was/is an open RCE in PHP and the impact was/is massive. Pity the teams on older versions especially.

varispeed  11 hours ago

Many exploits are used by security services, so this gives time to wrap any investigations or surveillance or find another method of accessing target servers.