Hacker News Reader

Comment by dangoodmanUT | Hacker News Reader

That is definitely very not good.

I got into software dev because of cyber sec, and almost everything I learned revolved around poorly implemented php, so I always stayed away from it when building

but this time it's php directly? that's scary

View on HN

There are regular security patches for basically everything these days, including OSs. Why does this notice stand out to you? The post suggests that they're being proactive, and discovered and patched these before they were exploited. Rather they take this transparent approach, as opposed to being silent and/or doing nothing.

This one stands out because it's trivially exploited over the internet on the default configuration for all PHP versions. Most vulnerabilities require being able to run malicious code on the machine or using some rare configuration.

If the rumors going around are true this will be the worst computer security incident in history.

It's not "trivially exploitable". Two or three years ago, this would be a critical issue but require quite some expertise to exploit and exploits definitely wouldn't spread like that. LLMs are shaking the entire security industry.

Yes but that means it is trivially exploitable today since anyone can get access to a LLM and where to point it towards. 2-3 years ago, things were different, that is also correct but that doesn't mean things stay frozen in time.

It's not trivially exploitable.

It's trivially exploitable because it requires no special set up, no special credentials, no privileged access of any kind. If you can call a PHP server and you have the exploit script, you can execute arbitrary code as their `www-data` user.

Usually, attacks are at least conditional and require something that weakens security guarantees.

It's not trivially exploitable.

Thanks, brand spanking new, jumble of letters account!

Are you forgetting about log4shell?

log4shell was easier to exploit. It also come with an initial patch that turned out to be incomplete, so everyone had to urgently patch every java web app twice!

Log4Shell required that the attacker be able to generate a log message containing specific parameters. It was a severe exploit, but not one that worked in every Java application with the affected Log4j versions. Attackers had to find calls that logged user submitted text or query paths first. So the list of prerequisites was larger: had to be using Log4j and had to have logging of user generated text.

Still a very large attack surface, but not nearly as ubiquitous as this one.

Heartbleed

Reply on news.ycombinator.com