Hacker News Reader

There are several PoCs, and according to Cloudflare, the vulnerability is already being actively exploited: https://x.com/dok2001/status/2112811965735202970

> Everybody who actively watches the topic already has the option to shut down their instances.

In theory. In practice, many can't just decide to shut down their service for a few hours.

Guess they can decide to let random hackers all over their server instead.

Is there any major service that has gone offline? Why is Wikipedia still up, did they manage to mitigate? What about Etsy?

WP sites like whitehouse.gov, TechCrunch, Time?

I don't see anything well known being down.

I would hazard a guess that Wordpress VIP and Wikipedia were given advance access to patches? These are the biggest users of PHP after all.

I the Netherlands multiple government organizations, and news sites are offline.

https://www.cyber.gov.au/alert/critical-vulnerabilities-in-p... is down for what it's worth. Lots of medium sized sites like deviant art are down right now.

Wikipedia patched it yesterday for the wiki itself, but most of their other tools are still down right now.

This leaked yesterday in part because so many people had advance notice.

You don't seem to understand how this works

An exploit can only "leak" if it's a private 0day used by APTs.

When warnings are sent out it has already been a public fact. Keeping some kind of dumbass embargo is just pointless theatre

"Windows 11 has a critical vulnerability."

Boom. A leak. It's now a public fact, so we'll instantly see people exploiting it, right? Except that without a commit or patch fixing it, or even a suggestion of a workaround, you are searching for a needle in a haystack. It could be literally anywhere, after all!

In fact, it is so well-hidden that I have not even discovered it myself yet. But its presence is a statistical certainty due to the sheer size of the codebase, so we should assume it is somewhere in there. Did I just doom every W11 user, or are perhaps embargoes at least somewhat useful?

You're missing the point

> I feel like all "non-inner-circle people" here are taken for a laugh. OpenAI and these security companies sat on this for 2 months, decided for themselves who gets access to an early fix, and then leave the rest out to dry

Had they just kept this between themselves and the vendor this would've been effective.

Instead they selectively released it to various parties one of which promptly leaked it.

This is exactly what should have been expected

Either it's 100% silent or it's out there

We just turned off uploads like they suggested to do. Our decision isn't "to let random hackers all over [our] server".

This is not an effective countermeasure.

The only mit is to deny all traffic to affected services. Uma Musume is taking itself offline. You can eat the downtime if gacha games can.

> umamusume

How does a mobile game use PHP? Wouldn't the game code use a custom socket and protocol for its comms?

Cygames loves PHP, most of their backend in most games are mostly PHP lol

Maybe that explains the terrible rng...

There's an exploit freely available already, by the way. You can't contain things like this.

If not, you or our agent could build an exploit from the information that's already out.

I have not seen confirmation that the exploit is for the bug that is going to be patched.

It seems the published exploit can be easily prevented by filtering out multipart post requests. So people actively watching the situation can already prevent that issue by filtering those.

Are you 100% sure? I have tested 2 PoC's against my dev environment, no luck so far. So I am not sure if there is working exploit already.

I was able to cook up something in less than 10 minutes and tested many sites. There is a page with enough explanations to do it.

Did you successfully run a RCE test, or only a vulnerability check? So far all write-ups and PoC's i've found fail to "cash in" on the RCE part.

I was able to bring it to the point of memory corruption. It is 3 am where I am now; I will continue in the morning. As a precaution, I configured .htaccess rule.

  # BEGIN php2shell-mitigation
  <IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTP:Content-Type} multipart [NC]
  RewriteRule .* - [F,L]
  </IfModule>
  <If "%{HTTP:Content-Type} =~ /multipart/i">
  Require all denied
  </If>
  # END php2shell-mitigation

I added a rewritecond to ignore multipart before php-fpm receives anything. I did a similar thing for nginx servers. Also in .user.ini added "session.upload_progress.enabled = Off".

These two seem to do the trick, but again I am not 1000% sure until tomorrow morning's deeper dive. My eyes are burning, and I can't sleep because of the stress this exploit.

I've done the same in caddy:

@multipart header_regexp Content-Type (?i)multipart respond @multipart 403

@uploads_php path_regexp uploads_php ^/(?:./)?wp-content/uploads/.\.php(?:/.*)?respond @uploads_php 404

Plus the php.ini changes, "session.upload_progress.enabled = Off" and strict mode. Let's hope it holds until then

    @multipart header_regexp Content-Type (?i)multipart
    respond @multipart 403

    @uploads_php path_regexp uploads_php ^/(?:.*/)?wp-content/uploads/.*\.php(?:/.*)?
    respond @uploads_php 404

> Having the patch probably makes creating an exploit easier. So the number of attacks would increase.

I think that this made sense a few years ago but in today's world it is so feasible to give an LLM a hint and throw some cash at it to find an exploit that I don't think this calculus makes sense anymore.

fwiw it looks like the patches were made available early on chainguard

https://images.chainguard.dev/directory/image/php/versions

How does it work that some service that most people never heard of distributes (paid) images with alleged fix for vuln 24h before official vuln fix/image is available? Seems somewhat shady.

thats chainguard’s entire value prop (they are quite well known in this sphere)

Good luck getting them to fix broken packages though.

Is there a public announcement? I can only see PHP 8.5.11 images, but having a recent build date is not enough to say they are indeed patched.

context: https://news.ycombinator.com/item?id=50176735

I can almost confirm a Wordpress site I manage was attacked with this. Oct 5th updated it to latest php and Wordpress. Oct 6th it was exploited with a web shell exploit

What ultimately ended up happening?

this is not a web shell exploit. This goes to container shell level. Very different scenarios.

On the other hand: it is Wordpress, who knows how many other exploits could be hiding among the dozens of plugins it likely has installed?

Yeh this isn't that.

systemctl mask/unmask

> Having the patch probably makes creating an exploit easier. So the number of attacks would increase.

No matter the excuse, the security issue must be fixed. Anyone trying to delay this is not acting in good faith. I understand your rationale but that does not excuse you from being labelled as such too.

We should live in the age of open source AT ALL TIMES. No exceptions, for anyone, no matter the reasons. And that includes those who want to withhold code or patches.

You might disagree with them, but I am pretty sure the php maintainers are acting in good faith.

Honestly, leaving everyone vulnerable and sitting on the patch while the exploits are out in the wild (i.e. no more use of delayed release) is hard to stomach.

A lot of people are going to do the math on migrating. Bugs happen everywhere. Leaving the community out in the cold and only supplying the corporate sponsors doesn't.