Hacker News Reader

The CVE wasn't clear about the impact and suggested every version after 5. That is going back over a fucking decade, almost two.

There's a lot of zombie software on the net that is ripe for the picking. More food for the botnet.

Wordpress in particular is a stupidly simple vector.

At this point, it would be fastest/most effective for the PHP foundation to deploy their own white-hat mass hacking attack to exploit the vulnerability and forcefully shutdown vulnerable servers.

I can't think of a faster way to clear out the vulnerable surface area.

Fastest, most effective and also illegal. Unless you use AI to do it I guess, then it is fine to hack people.

Yeah they should poorly set up a sandbox and ask it to fix all the vulnerable servers with the remote RCE and prepare to be surprised when it escapes the sandbox.

for debian there's https://deb.sury.org/

Ubuntu pro is free for up to 5 machines

PHP 8.1 on Ubuntu 22.04 had the fix backported and released via security.ubuntu.com

> There are so many keeping old php versions alive for compatibility with whatever software

If only there was a way to trivially rewrite just about any software