Comment by FreakLegion
6 hours ago
There were no known breaches or end-to-end exploits as of Friday. I've seen LLM hallucinations purporting to be exploits and real exploits missing pieces (address leaks), but nothing complete. Friends at some of the bigger IR practices (CrowdStrike CAO, Unit 42, Talos) have said the same thing.
It'll happen sooner or later, but all signs are that this was first and foremost a process nightmare. It wasn't another Log4Shell.
The RCE was a know thing on Wednesday, without too much info. People started putting mitigation and orgs with valuable websites were shutting down servers. Look at liveoverflow channel. Took him a good day with LLMs to find an exploit against a vanilla PHP instance. It isn't a straightforward hack. But it is possible.