Comment by kgeist
4 hours ago
I ran 2 PoCs from GitHub today: one indeed expected Local File Inclusion (LFI) to already be present (so it's just LFI with extra steps), and the other one didn't work at all out of the box without some modifications (although I used the same Docker images and all). The second PoC did trigger a real stale write bug in the end, but it didn't demonstrate actual RCE; it just triggered a stale write. And then I wondered, is this the first time ever that the PHP runtime has had a memory corruption bug? I doubt it (I remember a few years ago we had random crashes in production under high load due to an opcache bug). And if it's not the first memory corruption bug in the PHP runtime, why is it being proclaimed the worst vulnerability in years?
There is an argument to be made that taking down such a sizable chunk of the Internet automatically qualifies it as a pretty severe vulnerability, even if no actual exploits were involved in causing it.
More seriously, though, I read it as bad because of the potential. All versions of PHP going back a full two decades were affected, all users of PHP are affected regardless of which features they use, and it’s still unclear if there’s an effective mitigation. So the blast radius if anyone does/did have a working exploit would have been enormous.
I'm in charge of my employer's ecommerce website. To me there's a critical difference in severity between a RCE vulnerability and being to takedown/crash a website.
It didn't 'take down a sizable chunk of the Internet'. Site owners took down their sites because of FUD and mass hysteria.
It's not getting tripped by "mass hysteria" to be careful and go offline for a couple hours.
Your average site is fine at 99.9% uptime.
It's risk assessment, nothing more. Some weighed the risk high and paused their site. Nothing wrong with that and not hysteria or FUD.
> why is it being proclaimed the worst vulnerability in years?
Also announced today: OpenAI’s software vulnerability initiative.