← Back to context

Comment by skrrtww

7 hours ago

I dunno, the post is awfully critical of Chainguard for leaking a fixed binary 6 hours early, but it was the research firm "partner" that "mistakenly" posted the dancing anime POC video over 24 hours early that created the mass panic (not to mention spawning millions of agents crawling the php codebase and trying to brute force a POC and probably using more energy than a lot of countries in the process).

37 comments

skrrtww

Reply
john_strinlai  7 hours ago

i keep seeing mentions of the video, but is it still available anywhere?

corford  7 hours ago

Agree. If I'm following along correctly, it seems Calif is really the one to blame not Chaingaurd.

  • yardstick  6 hours ago

    Both are to blame.

    Calif more than Chainguard, but still Chainguard too.

    Calif was obviously twitching to claim credit for their findings, and what I find troubling is this eagerness was more important to them than giving users a chance to update their systems.

    Even if they ended up waiting only a day post release I would still say it seems a bit too soon. Maybe a week after. Not everyone’s system have aggressive patching schedules and PHP is soo heavily used.

    • kjs3  5 hours ago

      This is probably the future, tho. Being first to disclose a vuln is a Big Deal in some quarters. And now, the velocity of AI driven pentest swarms mean every researcher who finds something worthwhile has to think "how close is the next droog's swarm to finding what I found" and the temptation to jump the gun only gets stronger.

bawolff  6 hours ago

The video has no usable details in it.

It's maybe not professional to release an omg panic video, but not even remotely the same thing as what chainguard did.

  • dylan604  5 hours ago

    I don't know, it's showing most sites being pwnd in less than 20s with some taking just under 30s. Of course, that's on homeboy's local Mac. Not sure how long it takes to gain control with PHP2Shell to run the exploit though. Just started looking at that part myself

    • bawolff  4 hours ago

      So, just because they showed they can doesn't mean they showed how.

      I dont know why the timing of the bug is surprising to you.

  • numpad0  5 hours ago

    there were security guys publishing inferred details from [INFO] messages, it did contain more than zero usable details

    • bawolff  4 hours ago

      Everything i saw on twitter prior to the release turned out to be incorrect. At most people figured out it had something to do with session upload handler and UAF, but nobody knew what.

cubefox  7 hours ago

> but it was the research firm "partner" that "mistakenly" posted the dancing anime POC video over 24 hours early that created the mass panic

They took it down but someone (Kirill Firsov: https://x.com/k_firsov/status/2112641845926989944) added the anime stuff and reposted it. Totally irresponsible.

Edit: okay he didn't add the anime, but he reposted it.

  • debugnik  6 hours ago

    The company, Calif, has it with the music, effects and Ui Shigure animation on their own website and youtube channel: https://calif.io/php2shell/#php-5-4-0-rce

    • tetha  6 hours ago

      I think I'm too old for this industry

      I want to go back to talks by bored defcon guys or gals calmly stating how they obtained private keys of a globally trusted CA with just a bit of math. Which, mind you, ate the other part of the teams time.

      Now I know how much I hustled today likely due to that atrocity of a video. I think I will take a vacation day and sit in a forest near a river on friday.