Comment by 1718627440
5 hours ago
> I am very curious to hear why you thought it was overblown.
Not having made the claim (took down my website too), but because PHP is not connected directly to the network. While you cannot prevent PHP from being overtaken from inside the PHP program, you can prevent PHP being executed on malicious data by configuring the webserver. It's overblown in the sense that it would be even more serious if the same happened in the webserver itself.
Can you? Initial suggestions to block multipart content-types were a red herring.
In theory yes. In practice, I don't know, I hope my provider patched it properly.
What specific configuration would you recommend to block the vulnerability without actually patching it?
8 replies →