Hacker News Reader

Comment by burnJS | Hacker News Reader

How can I try this to see if I should shut things down myself. I run a 6 figure stealth and have a day job for fintech in 9 figures all php so kinda worried

View on HN

Used this as a base: https://jackalsyn.com/posts/php-up-2026.html

But created my own based on it since it feels sketchy running someone else's exploit poc ya know. Ran it first in a vm before running it against a production site.

I tried this more simplistic variant https://pastebin.com/kggc4q1T which supposedly would crash php but it was rejected by my CSRF middleware...

If you maintain a 9 figures business, I would recommend to not rely on that and shut it down or at least do more.

A 9-figure business with PHP is mind-boggling.

Wait til you hear about The Facebook.

Facebook hasn't used PHP for a very long time. It's been using Hack for over 12 years, which was initially based off PHP but it's deviated quite significantly now. It's now nearly entirely statically-typed, and has a bunch of features that PHP doesn't have. IO is fully asynchronous using async/await syntax (like C# or JavaScript), functions can be marked as pure, and a bunch of other things useful in large codebases.

It still uses the same request model as PHP, since that's genuinely useful for web requests. It's easier to avoid memory leaks if each request is entirely self-contained and there's no global state persisted between requests (other than APC and opcode caches)

How? This guy makes over $100k/mo from his PHP sites:

https://x.com/levelsio

Wait until you hear that banks use Perl.

Do you remember the last time Perl had a flaw like this that took every bank down? I don't.

bugzilla still relies on perl's non-existing tainting of hash keys. I fixed that about 10 years ago, but perl5 never did.

then you need to use a correct csrf token. it doesn't protect against this, anyone can get a valid csrf token, every visitor gets one.

This link gets me a shitton of extremely intrusiv ads, some of which look like malware (auto-downloading an "OperaSetup.exe"). Is pastebin already compromised?

I got this same earlier, but now it seems to be working. Perhaps just an oddly timed bug with some ads that has nothing to do with the incident?

Pastebin is just sketchy for a while now

it now serves ads that instantly start those downloads its been like that for a couple of weeks

I tried it too in a clean Debian Trixie container and got no crash.

On which OS and Server did you run the exploit against?

I ran the PoC on my dev environment, the PoC is not complete and does not work.

They've retracted RCE capabilities from that site, said they made a mistake and it's a crash bug. So what base did you use?

You make 9 figures at a fintech? Are you hiring?

Fintech makes 9 figures. I make 6 there and 6 at my stealth :-)

What is a "stealth"? A secret side project?

Basically taking two full-time jobs and lying about it

God I wish I had the energy to have 2 fulltime jobs. I barely have enough for 1

The problem with the hustle is that I'd have to hustle.

Mood.

It's my side business.

You use PHP at a fintech?

One of many languages. It has its role.

Reply on news.ycombinator.com