Comment by nemothekid
11 hours ago
I think the point is it is hard to claim that this exploit is the "end of the world", if it is trivially defeated by the default setup. Almost every deployment of php is going to be fronted by apache or nginx, and the default client_max_body_size for nginx is 1m.
I didn't say it's "end of the world". I am just saying it's an insane vulnerability.
It's not easily defeated by the default setup. Quite the contrary, the default setups are great. Typical apache + mod_php is the easiest to exploit. For example:
- Docker image `php:8.5.11-apache` is easy to exploit.
- Or the WordPress blog I installed with Digital Ocean template in 2023.
> It's not easily defeated by the default setup. Quite the contrary, the default setups are great. Typical apache + mod_php is the easiest to exploit.
But apache + mod_php hasn't been the default setup for a very long time, that's what people are trying to tell you. Given your expertise, you must know that already. So I have to conclude that you're arguing in bad faith because it's the only setup you can break.
I don't know this.
When I installed my WordPress blog with DigitalOcean template in 2023, it was Apache + mod_php.
Official WordPress docs mentions Apache before nginx: https://developer.wordpress.org/advanced-administration/serv...
Official php install instructions for Linux uses Apache + mod_php: https://www.php.net/manual/en/install.unix.debian.php