Comment by Topfi
11 hours ago
Can anyone explain the two month window between reporting and disclosure? I do understand Responsible Disclosure as a concept, but looking at the timeline and severity, I struggle to understand the timing, especially the month that passed before an acknowledgment.
Edit: Apparently this had been reported more than half a decade ago [0]. I am getting more confused the more I look into this, hopeful for a well written, factual post-mortem from someone who hasn't actively avoided PHP for the last decade.
How is a bug that was patched six years ago causing RCE today? Not sure your link is correct.
6 years ago it was deemed to be too complex to exploit and therefore not as high priority.
Can anyone explain the lack of the irresponsible disclosure in the 'Responsible' disclosure timeline? The one that happened just before the coordinated release?
Here's the missing part, as per the PHP announcement
> On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.
People should stop reading AI slop on X and other social media. The exploit is advanced and took some effort to fix. If there really was an open RCE in PHP for anyone to use the impact would be massive.
Sorry, what do you mean? There was/is an open RCE in PHP and the impact was/is massive. Pity the teams on older versions especially.
So what sites are confirmed to be "hacked" cause of this exploit? I mean, Log4J broke Minecraft and a lot of other services.
3 replies →
Many exploits are used by security services, so this gives time to wrap any investigations or surveillance or find another method of accessing target servers.