Rendered at 06:41:24 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
devttyeu 6 hours ago [-]
@dang if the speculations circulating around are anything to go by this is apocalyptic and deserves to be amplified such that the right people see this before it’s too late.
CERT-EU even suggests isolating any systems that may be exposed and can’t be patched quickly.
Speculation is that the affected subsystem runs before any application code and affects all default installs.
extraduder_ire 4 hours ago [-]
@dang is a no-op, you need to email him or the hn@ycombinator.com address
Numerlor 7 hours ago [-]
Well this is about as bad as it gets, so I guess the internet will get a bit of test and old forums will turn into a botnet
samueloph 10 hours ago [-]
Deciding to announce it like this is wild, it's an invitation for everyone to put their agents to work in order to find out what the vulnerability is and exploit it, while nobody is allowed to patch it until tomorrow.
nullbio 4 hours ago [-]
It's already been found and shared on X. It's only a matter of hours before untold numbers of sites are hacked.
I don't see any details of the vulnerability leaked except "code execution"...?
tossit444 10 hours ago [-]
It got flagged already, can't see it.
solyin 9 hours ago [-]
Whew! Imagine if the details were documented in the clear on HN for anyone to see.
4 hours ago [-]
unethical_ban 4 hours ago [-]
Rumored mitigation from other HN threads:
>Mitigation for impacted versions is to set `session.upload_progress.enabled = Off` in php.ini
It's a feature my wiki doesn't use, so even though I'm patching ASAP it did me no harm in flipping that bit. In fact, I could probably just shut down my server for the day...
edit: I simply shut down my dokuwiki for the day. No one uses it but me anyway.
Someone claiming to be a releng for PHP says INI settings won't save you.
potaytopotahto 5 hours ago [-]
Details about the exploits have already been leaked on twitter, don't want to put the details here but if its correct then it can be mitigated by setting session.upload_progress.enabled = Off
session.use_strict_mode = 1 as well. some advice around disabling multipart uploads too.
EGreg 4 hours ago [-]
I have heard Kirill Firsov say that, but does anyone even know the vulnerabilities? Could be a meme.
potaytopotahto 4 hours ago [-]
Yes its two hanging pointers related to the upload progress handler that can be used for RCE after some heap grooming, disabling upload progress means that the function that contains the vulnerable code never runs.
CERT-EU even suggests isolating any systems that may be exposed and can’t be patched quickly.
Speculation is that the affected subsystem runs before any application code and affects all default installs.
https://news.ycombinator.com/item?id=50167754
>Mitigation for impacted versions is to set `session.upload_progress.enabled = Off` in php.ini
It's a feature my wiki doesn't use, so even though I'm patching ASAP it did me no harm in flipping that bit. In fact, I could probably just shut down my server for the day...
edit: I simply shut down my dokuwiki for the day. No one uses it but me anyway.
edit2: https://old.reddit.com/r/PHP/comments/1xb2utu/upcoming_criti...
Someone claiming to be a releng for PHP says INI settings won't save you.
https://phpc.social/@Girgias/117476477429221001