Hacker News Reader

Comment by lynndotpy | Hacker News Reader

Just a heads up, as of my comment, this is not endorsed by PHP as a migration for the patch.

I wouldn't skip updating, but is there anything else we can do, other than simply shutting down the web server until the fix is available?

You could disconnect the web server from the internet!

I do not have details about any mitigation. There are rumors that people have independently come across php2shell exploits.

I shut down my servers five hours ago. This might have seemed premature at the time.

I think the best course of advice for most people is to shut down their servers as soon as they possibly can.

I applied the mitigation to all my servers when it was released, but now I've stopped all the httpds. A few hours of overnight downtime, vs potentially trying to restore everything from backups tomorrow. Everyone should weigh it up.

> as of my comment, this is not endorsed by PHP

Are you speaking officially here?

There are various mitigations suggested online, including completely blocking multipart requests at LB level. Is the combination of both effective?

I am not affiliated with PHP in any way or sense, I am saying this as someone who is able to see PHP's announcements, and there was no patch or mitigation announced by PHP.

I don't think pulling mitigations from random users online during a developing situation is a good idea. I think shutting down ones PHP services for the time being is a very good idea if that's an option.

"LB"?

Load balancer!

The PoC says so.

Reply on news.ycombinator.com