Comment by goalieca
3 hours ago
This is the least professional Video I’ve ever seen for anything like this. I can’t even follow what’s happening on screen.
3 hours ago
This is the least professional Video I’ve ever seen for anything like this. I can’t even follow what’s happening on screen.
that's the point: it essentially shows (notice the --profile-flag) the work of 2 months making the exploit work reliably on every app-php/fpm-linux-combination. The only purpose is to spread fear - and then have 50% of the internet update to a patched version with 425 changed files reviewed by ~100people and their clankers at 1400 UTC sharp while for the vast majority (using fpm like recommended for ~10years everywhere...) disabling the progress-something-flag and (optionally...) disabling multipart-uploads would have nicely mitigated this.
> disabling the progress-something-flag and (optionally...) disabling multipart-uploads would have nicely mitigated this.
I wouldn't be so sure. Many vulnerabilities have been "fixed" by blocking the particular ingress path of the demo exploit, and then it turns out that there were plenty more ways to exploit the bug, they just picked the easiest one.
Have you tried asking Claude? Maybe we're in the age of agent-to-agent communication /s