Comment by bawolff
9 hours ago
The video has no usable details in it.
It's maybe not professional to release an omg panic video, but not even remotely the same thing as what chainguard did.
9 hours ago
The video has no usable details in it.
It's maybe not professional to release an omg panic video, but not even remotely the same thing as what chainguard did.
I don't know, it's showing most sites being pwnd in less than 20s with some taking just under 30s. Of course, that's on homeboy's local Mac. Not sure how long it takes to gain control with PHP2Shell to run the exploit though. Just started looking at that part myself
So, just because they showed they can doesn't mean they showed how.
I dont know why the timing of the bug is surprising to you.
there were security guys publishing inferred details from [INFO] messages, it did contain more than zero usable details
Everything i saw on twitter prior to the release turned out to be incorrect. At most people figured out it had something to do with session upload handler and UAF, but nobody knew what.